Splunk Search

Need to add the numeric value after split

AdixitSplunk
Path Finder

HI All,

I have a log like below,there are under Message field in the logs :
ApplicationName date. total: 2.This is the count: 35
ApplicationName date. total: 3.This is the count: 39

I have used below query and want the sum of all the numeric values :
index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=mvindex(field,2)|eval field2=split(mvindex(field,1),".")|eval num1=mvindex(field2,0)|table num num1

which is giving below result as expected:
num num1
35 2
39 3

what i want is Sum :
num num1
35 2
39 3
Total 74 5
I have tried : query|addcolstotal num num1 and stats sum(num) by host etc...but they are just not working .

Thanks in advance

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=xyz sourcetype=abc 
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=xyz sourcetype=abc 
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals
0 Karma

AdixitSplunk
Path Finder

Thank you ..... It really helped

0 Karma

cmerriman
Super Champion

Try adding tonumber.

index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=tonumber(mvindex(field,2))|eval field2=split(mvindex(field,1),".")|eval num1=tonumber(mvindex(field2,0))|table num num1
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...