Reduce a result set using the foreach splunk search command

[lpolo]

The result of a splunk query is the following:

Result set 1:

method  success failures    Over_method1    Over_method2    Over_method3
method1 0   73               3                 0            0
method2 196 0                0                 2            0

I need to reduce this result set as follow:

method  success failures    Over
method1    0    73            3
method2   196   0             2

I tried using the search command foreach but no success.

Splunk search to get result set 1|
foreach Over_* [eval Over=Over+<<FIELD>>]|
table method success failures Over 

OR

Splunk to get result set 1|
foreach Over_* [eval Over=Over+'<<FIELD>>']|
table method success failures Over 

This could be done with the following query:

Splunk search to get result set 1|
=if(Over_method1>0,Over_method1,if(Over_method2>0,Over_method2,0))|
table method success failures Over 

However, A simpler way is to use the foreach function. To make it work the mapping variable needs to be initialized as presented in below answer. If not the result set will not be reduced correctly. So the final query is:

Splunk to get result set 1|eval Over=0|
foreach Over_* [eval Over=Over+'<<FIELD>>']|
table method success failures Over 

Thanks,
Lp

[lpolo]

However, After reading the answer presented bellow I made a little change for the eval expression to work, <> needs to be surrounded by single quotes.

[somesoni2]

Try this

Splunk search to get result set 1| eval Over=0 | foreach Over_* [eval Over=Over + <<FIELD>>]|table method success failures Over

Alternative (using untable)

Splunk search to get result set 1 | untable method key value  | eval key=case(like(key,"Over%"),"Over",1=1,key) | chart sum(value) over method by key

[lpolo]

Thanks. I made a little change for the eval expression to work, <> needs to be surrounded by single quotes. I updated the original question.

|Splunk search to get result set 1|eval Over=0 | foreach Over_* [eval Over=Over+'<>']|table method success failures Over