Splunk Search

Need help with Splunk Query

vinoths_82
Explorer

Hi

What I have:

I have a list of events with multiple <Key,Value> pairs. For eg., like below

event1:attributes:{"test__c":90, "abc":10,"now__c":10 }

event2:attributes:{"bcf:90, abc:10}

event1:attributes:{"testing__c":10, "abc":10,"now__c":100 }

As you can, some rows have attributes fields with a substr "__c" and the rest do not. 

What I want:

Now, I want to iterate over a list of events and calculate a total of all field values (fields which has substr __c) and display that in a table format like below

Total__C

100. (Since event 1 has 2 __c substr fields, their values add to 100)

0 (event2 has no __c fields, so default to 0)

110 (event3 has 2 fields)

What I tried:

I used foreach like below for 1 event, but I am not sure how to do it for all events iteratively.

fields * | foreach *__c [ eval TotalCustom = TotalCustom + '<<FIELD>>'] | table TotalCustom

Can someone help me with this?

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your solution was very close and the fix was not obvious.  This run-anywhere example works with your sample data, however.

| makeresults | eval data="event1:attributes:{\"test__c\":90, \"abc\":10, \"now__c\":10 }|
event2:attributes:{\"bcf\":90, \"abc\":10 }|
event1:attributes:{\"testing__c\":10, \"abc\":10, \"now__c\":100 }" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim="{, ", kvdelim=":"
```Above just defines test data```
| eval TotalCustom = 0 
| foreach *__c [ eval TotalCustom = TotalCustom + coalesce('<<FIELD>>', 0)]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Your solution was very close and the fix was not obvious.  This run-anywhere example works with your sample data, however.

| makeresults | eval data="event1:attributes:{\"test__c\":90, \"abc\":10, \"now__c\":10 }|
event2:attributes:{\"bcf\":90, \"abc\":10 }|
event1:attributes:{\"testing__c\":10, \"abc\":10, \"now__c\":100 }" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim="{, ", kvdelim=":"
```Above just defines test data```
| eval TotalCustom = 0 
| foreach *__c [ eval TotalCustom = TotalCustom + coalesce('<<FIELD>>', 0)]
---
If this reply helps you, Karma would be appreciated.

vinoths_82
Explorer

Thanks for the answer. 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...