Splunk Search

How to sum one field values based on other fields values

kirrusk
Communicator

i'm trying to sum one of the fields values based on the other field values.

For example

Source    Remediated      Space_id

         A               45                       156

         B                46                       199

         B               98                        233

         B                8                          233

         A                9                          156

         D                3                          148

 

So here i want to sum  the Remediated Values with the corresponding  space_id values.

if space_id is 233 then want to add 98+8.

Result should be like.

Source    Remediated      Space_id

         A                54                      156

         B                46                      199

         B               106                     233

         D                3                         148

is this possible . 

Please help me.

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk ,

try something like this:

your_search
| stats sum(Remediated) AS Remediated BY Source  Space_id
|  table Source Remediated Space_id

Ciao.

Giuseppe

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kirrusk 

 

Can you please try this?

 

YOUR_SEARCH  | stats sum(Remediated) as Remediated by Source,Space_id

 

 

Sample Search:

 

 

| makeresults | eval _raw="Source Remediated Space_id
A 45 156
B 46 199
B 98 233
B 8 233
A 9 156
D 3 148" | multikv forceheader=1 | stats sum(Remediated) as Remediated by Source,Space_id

 

 
0 Karma

gcusello
SplunkTrust
SplunkTrust

your_search

| stats sum(Remediated) AS Remediated BY Source  Space_id

|  table Source Remediated Space_id

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk ,

try something like this:

your_search
| stats sum(Remediated) AS Remediated BY Source  Space_id
|  table Source Remediated Space_id

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...