Splunk Search

Sum of the field based on the other field values

Anud
Path Finder

Hi Team,

how to Sum of the field based on the other field values.
Row1 field values will be 0-9 and a-z.
Sample one given below:

ROW1ROWcount
1122
1254
1334
a156
a278
d367
c478
c579


Final Output be like:

ROW1ROWcount
1110
a134
d67
c157


Thanks in Advance!!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

Anud
Path Finder

Logic was worked. Thank you  so much 

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...