Need to add the numeric value after split

[AdixitSplunk]

HI All,

I have a log like below,there are under Message field in the logs :
ApplicationName date. total: 2.This is the count: 35
ApplicationName date. total: 3.This is the count: 39

I have used below query and want the sum of all the numeric values :
index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=mvindex(field,2)|eval field2=split(mvindex(field,1),".")|eval num1=mvindex(field2,0)|table num num1

which is giving below result as expected:
num num1
35 2
39 3

what i want is Sum :
num num1
35 2
39 3
Total 74 5
I have tried : query|addcolstotal num num1 and stats sum(num) by host etc...but they are just not working .

Thanks in advance

[somesoni2 · Accepted solution]

Give this a try

index=xyz sourcetype=abc 
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals

[AdixitSplunk]

Thank you ..... It really helped

[cmerriman]

Try adding tonumber.

index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=tonumber(mvindex(field,2))|eval field2=split(mvindex(field,1),".")|eval num1=tonumber(mvindex(field2,0))|table num num1