Splunk Search

How to get sum for unique field values?

xvxt006
Contributor

Hi,

I saw that there is dc so we can get the distinct count but what if I want to get the sum for unique field values? I have tried something like this but it is missing some values. Any suggestions?

base search | dedup field | stats sum(field) as sum

s2_splunk
Splunk Employee
Splunk Employee

Is this what you mean?

base search | stats sum(value) as sum by field

Some example data would help, if that's not what you needed.

xvxt006
Contributor

Hi Thanks for checking. I have figured out this.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...