Splunk Search

How to calculate sum of two field values?

leujinlove
Explorer

I got a search result as below.

ClientType count


SI 130
Competotor1 115
Partner 70
Competotor2 20

However, I like to change the result, as sum of the count values of Competotor1 and Competotor2 is Competotor_total and delete the values of Competotor1 and Competotor2.
The changed result will be

ClientType count


Competotor_Total 135
SI 130
Partner 70

Could anyone help me how to do that?

Best Regards.

Tags (3)
0 Karma
1 Solution

vasanthmss
Motivator

Try this

| eval new_ClientType =if(ClientType LIKE "%Comp%", "Competotor_Total",ClientType ) | stats sum(count) by new_ClientType

V

View solution in original post

vasanthmss
Motivator

Try this

| eval new_ClientType =if(ClientType LIKE "%Comp%", "Competotor_Total",ClientType ) | stats sum(count) by new_ClientType

V

leujinlove
Explorer

Thanks to you, I could understand 'eval if' function.
Thanks a lot.

0 Karma

neeldesai1992
Path Finder

But how did you add two functions?

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...