sum specific field value

[ips_mandar]

I have below events-

value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1

Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.

[bangalorep · Accepted solution]

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum 

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum