Splunk Search

How to use sum() for the $ values?

kiran331
Builder

Hi I have a csv file with $6.00, $6.11,etc as values. How can user sum() for these values?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You would've to process the fields that contains values with dollar sign to remove $ so that Splunk can treat them as number and then you can apply sum aggregation. See this runanywhere sample search on one of the method to replace $ sign.

| gentimes start=-1 | eval field1="$6.00 $1.11" | table field1 | makemv field1 | mvexpand field1 | eval field2=replace(field1,"\$","") | stats sum(field2)

View solution in original post

0 Karma

somesoni2
Revered Legend

You would've to process the fields that contains values with dollar sign to remove $ so that Splunk can treat them as number and then you can apply sum aggregation. See this runanywhere sample search on one of the method to replace $ sign.

| gentimes start=-1 | eval field1="$6.00 $1.11" | table field1 | makemv field1 | mvexpand field1 | eval field2=replace(field1,"\$","") | stats sum(field2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...