Splunk Search

sum specific field value

ips_mandar
Builder

I have below events-

value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1

Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.

0 Karma
1 Solution

bangalorep
Communicator

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum

View solution in original post

bangalorep
Communicator

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...