Splunk Search

How to sum one field values based on other fields values

kirrusk
Communicator

i'm trying to sum one of the fields values based on the other field values.

For example

Source    Remediated      Space_id

         A               45                       156

         B                46                       199

         B               98                        233

         B                8                          233

         A                9                          156

         D                3                          148

 

So here i want to sum  the Remediated Values with the corresponding  space_id values.

if space_id is 233 then want to add 98+8.

Result should be like.

Source    Remediated      Space_id

         A                54                      156

         B                46                      199

         B               106                     233

         D                3                         148

is this possible . 

Please help me.

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk ,

try something like this:

your_search
| stats sum(Remediated) AS Remediated BY Source  Space_id
|  table Source Remediated Space_id

Ciao.

Giuseppe

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kirrusk 

 

Can you please try this?

 

YOUR_SEARCH  | stats sum(Remediated) as Remediated by Source,Space_id

 

 

Sample Search:

 

 

| makeresults | eval _raw="Source Remediated Space_id
A 45 156
B 46 199
B 98 233
B 8 233
A 9 156
D 3 148" | multikv forceheader=1 | stats sum(Remediated) as Remediated by Source,Space_id

 

 
0 Karma

gcusello
SplunkTrust
SplunkTrust

your_search

| stats sum(Remediated) AS Remediated BY Source  Space_id

|  table Source Remediated Space_id

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk ,

try something like this:

your_search
| stats sum(Remediated) AS Remediated BY Source  Space_id
|  table Source Remediated Space_id

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...