Sum by Name Regex

[splunk219783]

I've spent awhile messing around with this and can't get anything working. I need to sum a list like this by Storage1 and Storage2 to get a total of each Storage*. This is a much larger list in reality with a dozen or so different Storage#s, and Multiple locations.

I'd imagine i need some type of regex where i can sum by then sum by

Location1-Storage1-1, 500GB
Location1-Storage1-2, 250GB
Location1-Storage1-3, 200GB
Location2-Storage2-1, 100GB
Location2-Storage2-2, 150GB
Location2-Storage2-3, 150GB

Desired Output:

Storage1: 950GB
Storage2: 400GB
Location1: 950GB
Location 2: 400GB

[richgalloway · Accepted solution]

Try this query.

index=foo | rex "(?<location>[^\-]+?)-(?<storage>[^\-]+)-\d+, (?<size>\d+)" | stats sum(size) as TotalSize by location,storage

[splunk219783]

Thank you! This definitely got me on my way, i've got it working now.