Splunk Search

How to add a column that sums values while keeping the values column

Newser703
Explorer

Hello I have data that looks like this : 

 

Name	|	Type	|	Value
------------------------------------------
Name1	|	TypeA	|	2
Name1	|	TypeB	|	4
Name1	|	TypeC	|	6
Name2	|	TypeA	|	4
Name2	|	TypeB	|	8
Name2	|	TypeC	|	3
Name3	|	TypeA	|	1
Name3	|	TypeB	|	5
Name3	|	TypeC	|	7

 

 Is it possible to add a column that sums the values by Name while keeping the Value column, like this : 

 

Name	|	Type	|	Value	|	SumByName
---------------------------------------------------------
Name1	|	TypeA	|	2	|	12
Name1	|	TypeB	|	4	|	12
Name1	|	TypeC	|	6	|	12
Name2	|	TypeA	|	4	|	15
Name2	|	TypeB	|	8	|	15
Name2	|	TypeC	|	3	|	15
Name3	|	TypeA	|	1	|	13
Name3	|	TypeB	|	5	|	13
Name3	|	TypeC	|	7	|	13

 

 Thanks for the help.

Labels (2)
Tags (1)
0 Karma
1 Solution

venky1544
Builder

Hi @Newser703 

you can try eventstats  it should give you the output you are looking for

 

| makeresults |eval Name="Name1",Type="TypeA",Value=2
|append[|makeresults |eval Name="Name1",Type="TypeB",Value=4]
|append[|makeresults |eval Name="Name1",Type="TypeC",Value=6]
|append[|makeresults |eval Name="Name2",Type="TypeA",Value=4]
|append[|makeresults |eval Name="Name2",Type="TypeB",Value=8]
|append[|makeresults |eval Name="Name2",Type="TypeC",Value=3]
|append[|makeresults |eval Name="Name3",Type="TypeA",Value=1]
|append[|makeresults |eval Name="Name3",Type="TypeB",Value=5]
|append[|makeresults |eval Name="Name3",Type="TypeC",Value=7]
|eventstats sum(Value) AS SumbyName by Name |fields - _time

venky1544_0-1651756463723.png

 

If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

View solution in original post

venky1544
Builder

Hi @Newser703 

you can try eventstats  it should give you the output you are looking for

 

| makeresults |eval Name="Name1",Type="TypeA",Value=2
|append[|makeresults |eval Name="Name1",Type="TypeB",Value=4]
|append[|makeresults |eval Name="Name1",Type="TypeC",Value=6]
|append[|makeresults |eval Name="Name2",Type="TypeA",Value=4]
|append[|makeresults |eval Name="Name2",Type="TypeB",Value=8]
|append[|makeresults |eval Name="Name2",Type="TypeC",Value=3]
|append[|makeresults |eval Name="Name3",Type="TypeA",Value=1]
|append[|makeresults |eval Name="Name3",Type="TypeB",Value=5]
|append[|makeresults |eval Name="Name3",Type="TypeC",Value=7]
|eventstats sum(Value) AS SumbyName by Name |fields - _time

venky1544_0-1651756463723.png

 

If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...