Splunk Search

Need to add the numeric value after split

AdixitSplunk
Path Finder

HI All,

I have a log like below,there are under Message field in the logs :
ApplicationName date. total: 2.This is the count: 35
ApplicationName date. total: 3.This is the count: 39

I have used below query and want the sum of all the numeric values :
index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=mvindex(field,2)|eval field2=split(mvindex(field,1),".")|eval num1=mvindex(field2,0)|table num num1

which is giving below result as expected:
num num1
35 2
39 3

what i want is Sum :
num num1
35 2
39 3
Total 74 5
I have tried : query|addcolstotal num num1 and stats sum(num) by host etc...but they are just not working .

Thanks in advance

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=xyz sourcetype=abc 
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=xyz sourcetype=abc 
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals

View solution in original post

0 Karma

AdixitSplunk
Path Finder

Thank you ..... It really helped

0 Karma

cmerriman
Super Champion

Try adding tonumber.

index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=tonumber(mvindex(field,2))|eval field2=split(mvindex(field,1),".")|eval num1=tonumber(mvindex(field2,0))|table num num1
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!