Splunk Search

sum specific field value

ips_mandar
Builder

I have below events-

value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1

Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.

0 Karma
1 Solution

bangalorep
Communicator

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum

View solution in original post

bangalorep
Communicator

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...