Splunk Search

Count values from fields that may not exist

Rialf1959
Explorer

Hello,
How to sums values from fields that may not exists? I want to sums fields (if exists ) with this pattern: networks.^[a-zA-Z0-9]*$.rx_bytes

For example:

    index=myindex sourcetype=mysourcetype| eval count=('networks.eth0.rx_bytes' + 'networks.eth1.rx_bytes' + 'networks.eth2.rx_bytes' + 'networks.eth(n).rx_bytes' )

Thanks

0 Karma

HiroshiSatoh
Champion

Try this!

... | addtotals fieldname=count network.*.rx_bytes

Rialf1959
Explorer

Does not work.
Sample data:
https://pastebin.com/9sRs35Z3

EDIT: ofcourse, there is typo in field name. Network vs Networks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this. The foreach command accepts wildcards, but not regular expressions.

index=myindex sourcetype=mysourcetype | eval count=0 | foreach network.*.rx_bytes [eval count=count+<<FIELD>>] | table count

If you need to be specific about field matching, try this query.

index=myindex sourcetype=mysourcetype | eval count=0 | foreach network.*.rx_bytes [eval count=if(match(<<FIELD>>,"networks.^[a-zA-Z0-9]*$.rx_bytes"),count+<<FIELD>>, count)] | table count
---
If this reply helps you, Karma would be appreciated.

Rialf1959
Explorer

Does not work.
Sample data:
https://pastebin.com/9sRs35Z3

EDIT: ofcourse, there is typo in field name. Network vs Networks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...