Hello I have data that looks like this :
Name | Type | Value
------------------------------------------
Name1 | TypeA | 2
Name1 | TypeB | 4
Name1 | TypeC | 6
Name2 | TypeA | 4
Name2 | TypeB | 8
Name2 | TypeC | 3
Name3 | TypeA | 1
Name3 | TypeB | 5
Name3 | TypeC | 7
Is it possible to add a column that sums the values by Name while keeping the Value column, like this :
Name | Type | Value | SumByName
---------------------------------------------------------
Name1 | TypeA | 2 | 12
Name1 | TypeB | 4 | 12
Name1 | TypeC | 6 | 12
Name2 | TypeA | 4 | 15
Name2 | TypeB | 8 | 15
Name2 | TypeC | 3 | 15
Name3 | TypeA | 1 | 13
Name3 | TypeB | 5 | 13
Name3 | TypeC | 7 | 13
Thanks for the help.
Hi @Newser703
you can try eventstats it should give you the output you are looking for
| makeresults |eval Name="Name1",Type="TypeA",Value=2
|append[|makeresults |eval Name="Name1",Type="TypeB",Value=4]
|append[|makeresults |eval Name="Name1",Type="TypeC",Value=6]
|append[|makeresults |eval Name="Name2",Type="TypeA",Value=4]
|append[|makeresults |eval Name="Name2",Type="TypeB",Value=8]
|append[|makeresults |eval Name="Name2",Type="TypeC",Value=3]
|append[|makeresults |eval Name="Name3",Type="TypeA",Value=1]
|append[|makeresults |eval Name="Name3",Type="TypeB",Value=5]
|append[|makeresults |eval Name="Name3",Type="TypeC",Value=7]
|eventstats sum(Value) AS SumbyName by Name |fields - _time
If it helps karma is appreciated/if it resolves acceptance as solution is appreciated
Hi @Newser703
you can try eventstats it should give you the output you are looking for
| makeresults |eval Name="Name1",Type="TypeA",Value=2
|append[|makeresults |eval Name="Name1",Type="TypeB",Value=4]
|append[|makeresults |eval Name="Name1",Type="TypeC",Value=6]
|append[|makeresults |eval Name="Name2",Type="TypeA",Value=4]
|append[|makeresults |eval Name="Name2",Type="TypeB",Value=8]
|append[|makeresults |eval Name="Name2",Type="TypeC",Value=3]
|append[|makeresults |eval Name="Name3",Type="TypeA",Value=1]
|append[|makeresults |eval Name="Name3",Type="TypeB",Value=5]
|append[|makeresults |eval Name="Name3",Type="TypeC",Value=7]
|eventstats sum(Value) AS SumbyName by Name |fields - _time
If it helps karma is appreciated/if it resolves acceptance as solution is appreciated