Splunk Search

How do I get the sum of values for non-unique fields?

cabbageel
New Member

Hi.

I have 4 events with field smsresult= , and I have to sum the values of this field. I tried to use

stats sum(SMSRESULT) 

The problem is that some events are absolutely same and Splunk ignores repeated values.
For example sum of

... smsresult=9
... smsresult=9
... smsresult=1
... smsresult=9

returns me not 28, but 10.

What I have to do to fix this?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you provide your full search that you're using?

0 Karma

rfaircloth_splu
Splunk Employee
Splunk Employee

In the example given is smsresult= a multiple kv field within the same event?

Try
* | mvexpand smsresult | stats sum(smsresult)

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Stats sum will work fine (as intended) without mvexpand as well. see this runanywhere sample

| gentimes start=-1 | eval temp="1,3,3,3" | makemv temp delim="," | stats sum(temp) list(temp)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...