extract multiple fields(number unknown) and sum it up

[Christian]

i have several events which look like this one (this is one event, repeating with varios values after Txxxx,)

DISKBUSY,T0012,0.1,0.0,0.1,0.0,0.0,0.5,0.0

DISKREAD,T0012,0.1,0.0,0.0,0.0,0.0,149.4,0.0

DISKWRITE,T0012,9.0,0.1,0.8,0.2,0.0,39.2,0.2

DISKXFER,T0012,2.1,0.0,0.2,0.1,0.0,11.3,0.1

DISKBSIZE,T0012,4.2,4.0,4.0,4.0,0.0,16.7,4.0

I have now two issues the first is i would like to create a new field for example sum_DISKXFER which has the value the sum of the values of the line behind DISKXFER,T0012, which where separated by a "," but the problem is this is not a fix number (depending on the number of disk).

my second issue, to visualize the different disks performance i would like to extract a field for each value for example DISKXFER,T0012,(field1) = 2.1,(field2) = 0.0,(field3) = 0.2,(field4) = 0.1,(field5) = 0.0,(field6) = 11.3,(field7) = 0.1

here i have the same problem this can be different for some hosts. (sure my search will extract only one host which has always the same amount of disk, but the search should work for all hosts)

i hope you understand my strange question, thanks for any help
christian

[woodcock]

I don't know of a way to do it as separate field names but it can be done as a multi-value field like this:

... | rex "^[^,]*,[^,]*(?<myField>.*)$ | eval myMvField=split(myField,",")

Then install this:

http://jordan.broughs.net/archives/2012/06/mvsum-for-splunk-summing-multi-valued-fields-within-a-sin...