Splunk Search

Sum of the field based on the other field values

Anud
Path Finder

Hi Team,

how to Sum of the field based on the other field values.
Row1 field values will be 0-9 and a-z.
Sample one given below:

ROW1ROWcount
1122
1254
1334
a156
a278
d367
c478
c579


Final Output be like:

ROW1ROWcount
1110
a134
d67
c157


Thanks in Advance!!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

Anud
Path Finder

Logic was worked. Thank you  so much 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...