HI All,
I have a log like below,there are under Message field in the logs :
ApplicationName date. total: 2.This is the count: 35
ApplicationName date. total: 3.This is the count: 39
I have used below query and want the sum of all the numeric values :
index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=mvindex(field,2)|eval field2=split(mvindex(field,1),".")|eval num1=mvindex(field2,0)|table num num1
which is giving below result as expected:
num num1
35 2
39 3
what i want is Sum :
num num1
35 2
39 3
Total 74 5
I have tried : query|addcolstotal num num1 and stats sum(num) by host etc...but they are just not working .
Thanks in advance
Give this a try
index=xyz sourcetype=abc
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals
Give this a try
index=xyz sourcetype=abc
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals
Thank you ..... It really helped
Try adding tonumber.
index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=tonumber(mvindex(field,2))|eval field2=split(mvindex(field,1),".")|eval num1=tonumber(mvindex(field2,0))|table num num1