Splunk Search

Sum of the field based on the other field values

Anud
Path Finder

Hi Team,

how to Sum of the field based on the other field values.
Row1 field values will be 0-9 and a-z.
Sample one given below:

ROW1ROWcount
1122
1254
1334
a156
a278
d367
c478
c579


Final Output be like:

ROW1ROWcount
1110
a134
d67
c157


Thanks in Advance!!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

Anud
Path Finder

Logic was worked. Thank you  so much 

Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...