Splunk Search

Sum of the field based on the other field values

Anud
Path Finder

Hi Team,

how to Sum of the field based on the other field values.
Row1 field values will be 0-9 and a-z.
Sample one given below:

ROW1ROWcount
1122
1254
1334
a156
a278
d367
c478
c579


Final Output be like:

ROW1ROWcount
1110
a134
d67
c157


Thanks in Advance!!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.

| rex field=ROW1 "(?<ROW1>.)"
| stats sum(ROWcount) as ROWcount by ROW1
---
If this reply helps you, Karma would be appreciated.

Anud
Path Finder

Logic was worked. Thank you  so much 

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...