Splunk Search

Suming up fields only once based on field

Jimenez
Explorer

Hi all, 

I have the following situation with a query returning a table of this kind:

fieldAfieldB
A2
A2
B4
B4

 

I need to add a column to this table that sums up fieldB only once per fieldA unique value, meaning a new column that sums 2+4 = 6

table would look like this:

fieldAfieldBsum_unique
A26
A26
B46
B46

 

I know that I have to use | eventstats sum() here but I am struggling how to define it has to be once per fieldA unique value.

Thanks in advance

Miguel

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe
    [| chart values(fieldB) as unique by fieldA]
| eventstats sum(unique) as sum_unique
| where isnull(unique)
| fields - unique

View solution in original post

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Jimenez 

kiran_panchavat_0-1747815864810.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe
    [| chart values(fieldB) as unique by fieldA]
| eventstats sum(unique) as sum_unique
| where isnull(unique)
| fields - unique
0 Karma

Jimenez
Explorer

Works great!. Thanks!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...