Splunk Search

Sum up values into a row with the data grouped by fields

madakkas
Explorer

I have the below sample data

Groups Values
G1 1
G1 2
G1 1
G1 2
G3 3
G3 3
G3 3

I am looking to sum up the values field grouped by the Groups and have it displayed as below .

Groups  Values  Sum
G1  1   8
G1  5   8
G1  1   8
G1  1   8
G3  3   9
G3  3   9
G3  3   9

the reason is that i need to eventually develop a scorecard model from each of the Groups and other variables in each row. All help is appreciated.

thank You to all the splunk gurus here.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Can you try somethins:

| makeresults | eval abc="G1 1,G1 5,G1 1,G1 1,G3 3,G3 3,G3 3"  | makemv delim="," abc | mvexpand abc | rex field=abc "(?P<Group>[^\s]+)\s(?P<Value>.+)" | stats sum(Value) list(Value) AS abc1 by Group  | mvexpand abc1

OR

| makeresults | eval abc="G1 1 G1 5 G1 1 G1 1 G3 3 G3 3 G3 3"  | rex field=abc max_match=0 "(?P<Group>[^\s]+)\s(?P<Value>[^\s]+)" | eval ab=mvzip(Group,Value) | mvexpand ab | rex field=ab max_match=0 "(?P<Group>[^,]+),(?P<Value>.+)" | stats sum(Value) AS Sum list(Value) AS Value by Group | mvexpand Value

View solution in original post

0 Karma

TISKAR
Builder

@madakkas, Can youu try this please:

<yourBaseSearch>| eventstats sum(Value) by Group

For Example:

| makeresults | eval abc="G1 1 G1 5 G1 1 G1 1 G3 3 G3 3 G3 3"  | rex field=abc max_match=0 "(?P<Group>[^\s]+)\s(?P<Value>[^\s]+)" | eval ab=mvzip(Group,Value) | mvexpand ab | rex field=ab max_match=0 "(?P<Group>[^,]+),(?P<Value>.+)" | eventstats sum(Value) as sum by Group 
| fields Group Value sum

woodcock
Esteemed Legend

What do your raw events (fields) look like?

0 Karma

madakkas
Explorer

Raw Events are in a csv file

0 Karma

p_gurav
Champion

Can you try somethins:

| makeresults | eval abc="G1 1,G1 5,G1 1,G1 1,G3 3,G3 3,G3 3"  | makemv delim="," abc | mvexpand abc | rex field=abc "(?P<Group>[^\s]+)\s(?P<Value>.+)" | stats sum(Value) list(Value) AS abc1 by Group  | mvexpand abc1

OR

| makeresults | eval abc="G1 1 G1 5 G1 1 G1 1 G3 3 G3 3 G3 3"  | rex field=abc max_match=0 "(?P<Group>[^\s]+)\s(?P<Value>[^\s]+)" | eval ab=mvzip(Group,Value) | mvexpand ab | rex field=ab max_match=0 "(?P<Group>[^,]+),(?P<Value>.+)" | stats sum(Value) AS Sum list(Value) AS Value by Group | mvexpand Value
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...