Hi @varsh_6_8_6 , you can find many anwers to this question and I proposed it in Splunk ideas to have this feature in fashboards and it's a future prospect, if you think that's interesting, upvote f...
See more...
Hi @varsh_6_8_6 , you can find many anwers to this question and I proposed it in Splunk ideas to have this feature in fashboards and it's a future prospect, if you think that's interesting, upvote for it at https://ideas.splunk.com/ideas/EID-I-572 Anyway, in the meantime, only one question before the answer: is messageValue a number or what else? if it's a number, please try: index="xyz" host="*" "total payment count :"
| eval messagevalue=mvindex(split(messagevalue,":"),1)
| stats latest(messagevalue) AS messagevalue
| append [ | makeresults | eval messagevalue=0 | fields messagevalue ]
| stats sum(messagevalue) AS messagevalue Ciao. Giuseppe