Splunk Search

Sum of the field based on the other field values

Anud
Path Finder

Hi Team,

how to Sum of the field based on the other field values.
Row1 field values will be 0-9 and a-z.
Sample one given below:

ROW1ROWcount
1122
1254
1334
a156
a278
d367
c478
c579


Final Output be like:

ROW1ROWcount
1110
a134
d67
c157


Thanks in Advance!!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

Anud
Path Finder

Logic was worked. Thank you  so much 

Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...