Splunk Search

How to calculate sum of two field values?

leujinlove
Explorer

I got a search result as below.

ClientType count


SI 130
Competotor1 115
Partner 70
Competotor2 20

However, I like to change the result, as sum of the count values of Competotor1 and Competotor2 is Competotor_total and delete the values of Competotor1 and Competotor2.
The changed result will be

ClientType count


Competotor_Total 135
SI 130
Partner 70

Could anyone help me how to do that?

Best Regards.

Tags (3)
0 Karma
1 Solution

vasanthmss
Motivator

Try this

| eval new_ClientType =if(ClientType LIKE "%Comp%", "Competotor_Total",ClientType ) | stats sum(count) by new_ClientType

V

View solution in original post

vasanthmss
Motivator

Try this

| eval new_ClientType =if(ClientType LIKE "%Comp%", "Competotor_Total",ClientType ) | stats sum(count) by new_ClientType

V

leujinlove
Explorer

Thanks to you, I could understand 'eval if' function.
Thanks a lot.

0 Karma

neeldesai1992
Path Finder

But how did you add two functions?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...