Splunk Search

How to get sum for unique field values?

Contributor

Hi,

I saw that there is dc so we can get the distinct count but what if I want to get the sum for unique field values? I have tried something like this but it is missing some values. Any suggestions?

base search | dedup field | stats sum(field) as sum

Splunk Employee
Splunk Employee

Is this what you mean?

base search | stats sum(value) as sum by field

Some example data would help, if that's not what you needed.

Contributor

Hi Thanks for checking. I have figured out this.

0 Karma