Splunk Search

sum specific field value

ips_mandar
Builder

I have below events-

value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1

Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.

0 Karma
1 Solution

bangalorep
Communicator

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum

View solution in original post

bangalorep
Communicator

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...