Sum of Multivalue (list) Items

[OliverG91]

Given this search result:
Company A         Visa            15
                                 MC                5
                                 AmEx           2
Company B         Visa            19
                                 MC                8
                                 AmEx           3

How can I generate a total row like this?
Total                      Visa            34
                                 MC             13
                                 AmEx           5

[livehybrid · Accepted solution]

Hi @OliverG91 

You could try something like this, but its based on very little info - might work though!

adjust the type,count to whatever your two fields with that data is called.

| eval vals=mvzip(type,count)
| mvexpand vals
| makemv vals delim=","
| eval cardType=mvindex(vals,0), count=mvindex(vals,1)
| stats sum(count) as count by cardType

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[OliverG91]

I had to reformat your solution and plugged it in " | appendpipe" (appended from my  main search):
| appendpipe [eval vals=mvzip(card_type,card_count) | mvexpand vals | makemv vals delim="," | eval card_type=mvindex(vals,0), card_count=mvindex(vals,1) | stats sum(card_count) AS card_count BY card_type | eval company_name="TOTAL" | stats list(card_type) AS card_type, list(card_count) AS card_type BY company_name]

and it seemed to work! Thank you for this

[livehybrid]

Hi,

Can you tell me what this looks like as events, or how you got to them? Are the card types and counts a list generated from stats?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[OliverG91]

The query used to obtain the above result is something like this:
[mainsearch]

| stats count as card_count BY company_name, card_type

| stats list(card_type) AS card_type, list(card_count) AS card_count BY company_name

I'm looking to add a totals row with the details shown above