Splunk Search
Highlighted

## Table with with a column that contains positive and negative values. I want to sum the total of all values and have the results as a Total, but it ignores the negative values. What am I doing wrong?

New Member

| table Account "Estimated GainLoss"
| sort -"Estimated Gain
Loss"

Tags (5)
1 Solution
Highlighted

## Re: Table with with a column that contains positive and negative values. I want to sum the total of all values and have the results as a Total, but it ignores the negative values. What am I doing wrong?

New Member

I just realized the sample data I posted had slight formatting error, but the problem is still the same. The samples below have the correct values.

Results in Excel with the output that I am looking for

Account Estimated Gain_Loss
Total 3200
ACCOUNT1 1000
ACCOUNT2 2000
ACCOUNT3 500
ACCOUNT4 -300

Results in Splunk with incorrect total

Account Estimated Gain_Loss
Total 3500
ACCOUNT1 1000
ACCOUNT2 2000
ACCOUNT3 500
ACCOUNT4 -300

Highlighted

## Re: Table with with a column that contains positive and negative values. I want to sum the total of all values and have the results as a Total, but it ignores the negative values. What am I doing wrong?

Ultra Champion

hi, @ihaveasplunkaccount

| makeresults
| eval raw="Account EstimatedGainLoss
ACCOUNT1 1000
ACCOUNT2 2000
ACCOUNT3 500
ACCOUNT4 -300"
| table Account Estimated
Gain_Loss

This query shows correct result. but,

| makeresults
| eval raw="Account EstimatedGainLoss
ACCOUNT1 \$1000
ACCOUNT2 \$2000
ACCOUNT3 \$500
ACCOUNT4 -\$300"
| table Account Estimated
Gain_Loss

this query is not work.

your sample has `\$` mark. Actually, is this right?

| makeresults
| eval raw="Account EstimatedGainLoss
ACCOUNT1 \$1000
ACCOUNT2 \$2000
ACCOUNT3 \$500
ACCOUNT4 -\$300"
| table Account Estimated
GainLoss
| eval Estimated
GainLoss=replace(EstimatedGain_Loss,"\\$","")
this query excludes `\$` mark and calculates total.