Splunk Search

Suming up fields only once based on field

Jimenez
Explorer

Hi all, 

I have the following situation with a query returning a table of this kind:

fieldAfieldB
A2
A2
B4
B4

 

I need to add a column to this table that sums up fieldB only once per fieldA unique value, meaning a new column that sums 2+4 = 6

table would look like this:

fieldAfieldBsum_unique
A26
A26
B46
B46

 

I know that I have to use | eventstats sum() here but I am struggling how to define it has to be once per fieldA unique value.

Thanks in advance

Miguel

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe
    [| chart values(fieldB) as unique by fieldA]
| eventstats sum(unique) as sum_unique
| where isnull(unique)
| fields - unique

View solution in original post

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Jimenez 

kiran_panchavat_0-1747815864810.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe
    [| chart values(fieldB) as unique by fieldA]
| eventstats sum(unique) as sum_unique
| where isnull(unique)
| fields - unique
0 Karma

Jimenez
Explorer

Works great!. Thanks!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...