Hi all,  I have the following situation with a query returning a table of this kind: fieldA fieldB A 2 A 2 B 4 B 4   I need to add a column to this table that sums up fieldB only once per fieldA unique value, meaning a new column that sums 2+4 = 6 table would look like this: fieldA fieldB sum_unique A 2 6 A 2 6 B 4 6 B 4 6   I know that I have to use | eventstats sum() here but I am struggling how to define it has to be once per fieldA unique value. Thanks in advance Miguel     ... View more

  Hi all, First of all thank you for your time. I am quite new to splunk and I am struggling with this issue for some time but it seems quite more challenging than I initially expected. I have this following sample data in tabular form: A B C D E F 0.1 b1 0.1 d1 0.1 f1 0.11 b2 0.2 d2 0.35 f2 0.2 b3 0.3 d3 0.9 f3 0.22 b4     1.0 f4 0.4 b5         0.5 b6         0.55 b7         0.9 b8           and I need to generate something like: A B C D E F 0.1 b1 0.1 d1 0.1 f1 0.11 b2         0.2 b3 0.2 d2     0.22 b4         0.3   0.3 d3     0.35       0.35 f2 0.4 b5         0.5 b6         0.55 b7         0.9 b8     0.9 f3 1.0       1.0 f4   So, first I need to merge column A with C and E sorted and then I need to make columns C and E match with column A including data in columns D and F respectively. I guess there is an easy way to achieve this. I have tried with joins but I cannot make it work. Any help would be much appreciated.             ... View more