Splunk Search

How to get sum for unique field values?

xvxt006
Contributor

Hi,

I saw that there is dc so we can get the distinct count but what if I want to get the sum for unique field values? I have tried something like this but it is missing some values. Any suggestions?

base search | dedup field | stats sum(field) as sum

s2_splunk
Splunk Employee
Splunk Employee

Is this what you mean?

base search | stats sum(value) as sum by field

Some example data would help, if that's not what you needed.

xvxt006
Contributor

Hi Thanks for checking. I have figured out this.

0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...