Splunk Search

Why are there sum issues in splunk table?


splunk table not giving the accurate sum of the fields in addtotals, even when i use the stats sum function, once the nos exceed 100000, it will not sum itinnacurate result in the addtotalsinnacurate result in the addtotals

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

it would be a little easier to help if you included the search you used, but from what i can see its because you have a mix of number and text strings. 1234 is a number 1,234 is a string, its adding the numbers and skipping the strings.

to fix you need to either;


a. do your sums before adding commas


b. convert you strings to numbers before doing the math
ie | eval numbers=tostring(<string_field>,"commas") | stats sum(numbers)
tonumber(<str>, <base>) .


Feel free to reply with your original search if you need any further help.

0 Karma


Wow, many thanks @duncangoff3 you are awesome

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...