Splunk Search

How to Use Eval to add 2 Field Values

promukh
Path Finder

Search --

|source1 | stats count(source1.field1) by (source1.field2) | sort 0 source1.field2

  • Search Output

source1.field2 | count
dev | 6
prod | 5
uat | 7
qa | 8

  • How can we add count values of 'prod' and 'uat' & also to display the field value as below , Is this doable ? *

source1.field2 | count
dev | 6
prod + uat | 12
qa | 8

0 Karma

to4kawa
Ultra Champion

| makeresults
| eval _raw="Source1_field2,Count
dev,6
prod,5
uat,7
qa,8"
| multikv forceheader=1
| table Source1_field2,Count
| rename COMMENT as "this is sample your stats output"
| transpose 0 header_field=Source1_field2
| eval "prod + uat"=prod+uat
| fields - prod uat

| transpose 0 column_name="Source1_field2" header_field=column

This query aims to aggregate after stats

| makeresults
| eval _raw="Source1_field2,Count
dev,6
prod,5
uat,7
qa,8"
| multikv forceheader=1
| table Source1_field2,Count
| eval range=mvrange(0,Count)
| mvexpand range
| rename COMMENT as "this your log sample, from here, the logic"
| eval Source1_field2=if(Source1_field2="prod" OR Source1_field2="uat","prod + uat",Source1_field2)

| stats count as Count by Source1_field2

This query aims to aggregate "prod + uat" and others.

Code Sample is useless when multikv forceheader=1 , because extra space is added.
I am troubled.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults count=6 
| eval field2="dev" 
| append 
    [| makeresults count=5 
    | eval field2="prod"] 
| append 
    [| makeresults count=7 
    | eval field2="uat"] 
| append 
    [| makeresults count=8 
    | eval field2="qa"] 

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| stats count BY field2 
| sort 0 field2
| eval env="count"
| xyseries env field2 count
| eval prod_n_uat = prod + uat
| fields - prod uat
| untable env field2 count
| fields - env
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add an eval after stats.

source1 | stats count(source1.field1) by (source1.field2) | eval sum=prod + uat | sort 0 source1.field2
---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

Not without tabling it first.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...