Need help with Splunk Query

[vinoths_82]

Hi

What I have:

I have a list of events with multiple <Key,Value> pairs. For eg., like below

event1:attributes:{"test__c":90, "abc":10,"now__c":10 }

event2:attributes:{"bcf:90, abc:10}

event1:attributes:{"testing__c":10, "abc":10,"now__c":100 }

As you can, some rows have attributes fields with a substr "__c" and the rest do not. 

What I want:

Now, I want to iterate over a list of events and calculate a total of all field values (fields which has substr __c) and display that in a table format like below

Total__C

100. (Since event 1 has 2 __c substr fields, their values add to 100)

0 (event2 has no __c fields, so default to 0)

110 (event3 has 2 fields)

What I tried:

I used foreach like below for 1 event, but I am not sure how to do it for all events iteratively.

fields * | foreach *__c [ eval TotalCustom = TotalCustom + '<<FIELD>>'] | table TotalCustom

Can someone help me with this?

[richgalloway · Accepted solution]

Your solution was very close and the fix was not obvious.  This run-anywhere example works with your sample data, however.

| makeresults | eval data="event1:attributes:{\"test__c\":90, \"abc\":10, \"now__c\":10 }|
event2:attributes:{\"bcf\":90, \"abc\":10 }|
event1:attributes:{\"testing__c\":10, \"abc\":10, \"now__c\":100 }" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim="{, ", kvdelim=":"
```Above just defines test data```
| eval TotalCustom = 0 
| foreach *__c [ eval TotalCustom = TotalCustom + coalesce('<<FIELD>>', 0)]

[vinoths_82]

Thanks for the answer.