Splunk Search

sum specific field value Builder

I have below events-

value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1

Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.

Tags (2)
1 Solution Communicator

You can try this,

| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats current=f window=1 last(value) as break
| append
[| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum

In your case, it will be

|  streamstats current=f window=1 last(value) as break
| append
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum Communicator

You can try this,

| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats current=f window=1 last(value) as break
| append
[| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum

In your case, it will be

|  streamstats current=f window=1 last(value) as break
| append 