Splunk Search

Sum by Name Regex

splunk219783
Path Finder

I've spent awhile messing around with this and can't get anything working. I need to sum a list like this by Storage1 and Storage2 to get a total of each Storage*. This is a much larger list in reality with a dozen or so different Storage#s, and Multiple locations.

I'd imagine i need some type of regex where i can sum by then sum by

Location1-Storage1-1, 500GB
Location1-Storage1-2, 250GB
Location1-Storage1-3, 200GB
Location2-Storage2-1, 100GB
Location2-Storage2-2, 150GB
Location2-Storage2-3, 150GB

Desired Output:

Storage1: 950GB
Storage2: 400GB
Location1: 950GB
Location 2: 400GB

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this query.

index=foo | rex "(?<location>[^\-]+?)-(?<storage>[^\-]+)-\d+, (?<size>\d+)" | stats sum(size) as TotalSize by location,storage
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this query.

index=foo | rex "(?<location>[^\-]+?)-(?<storage>[^\-]+)-\d+, (?<size>\d+)" | stats sum(size) as TotalSize by location,storage
---
If this reply helps you, Karma would be appreciated.

splunk219783
Path Finder

Thank you! This definitely got me on my way, i've got it working now.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...