Splunk Search

Sum up values into a row with the data grouped by fields

madakkas
Explorer

I have the below sample data

Groups Values
G1 1
G1 2
G1 1
G1 2
G3 3
G3 3
G3 3

I am looking to sum up the values field grouped by the Groups and have it displayed as below .

Groups  Values  Sum
G1  1   8
G1  5   8
G1  1   8
G1  1   8
G3  3   9
G3  3   9
G3  3   9

the reason is that i need to eventually develop a scorecard model from each of the Groups and other variables in each row. All help is appreciated.

thank You to all the splunk gurus here.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Can you try somethins:

| makeresults | eval abc="G1 1,G1 5,G1 1,G1 1,G3 3,G3 3,G3 3"  | makemv delim="," abc | mvexpand abc | rex field=abc "(?P<Group>[^\s]+)\s(?P<Value>.+)" | stats sum(Value) list(Value) AS abc1 by Group  | mvexpand abc1

OR

| makeresults | eval abc="G1 1 G1 5 G1 1 G1 1 G3 3 G3 3 G3 3"  | rex field=abc max_match=0 "(?P<Group>[^\s]+)\s(?P<Value>[^\s]+)" | eval ab=mvzip(Group,Value) | mvexpand ab | rex field=ab max_match=0 "(?P<Group>[^,]+),(?P<Value>.+)" | stats sum(Value) AS Sum list(Value) AS Value by Group | mvexpand Value

View solution in original post

0 Karma

TISKAR
Builder

@madakkas, Can youu try this please:

<yourBaseSearch>| eventstats sum(Value) by Group

For Example:

| makeresults | eval abc="G1 1 G1 5 G1 1 G1 1 G3 3 G3 3 G3 3"  | rex field=abc max_match=0 "(?P<Group>[^\s]+)\s(?P<Value>[^\s]+)" | eval ab=mvzip(Group,Value) | mvexpand ab | rex field=ab max_match=0 "(?P<Group>[^,]+),(?P<Value>.+)" | eventstats sum(Value) as sum by Group 
| fields Group Value sum

woodcock
Esteemed Legend

What do your raw events (fields) look like?

0 Karma

madakkas
Explorer

Raw Events are in a csv file

0 Karma

p_gurav
Champion

Can you try somethins:

| makeresults | eval abc="G1 1,G1 5,G1 1,G1 1,G3 3,G3 3,G3 3"  | makemv delim="," abc | mvexpand abc | rex field=abc "(?P<Group>[^\s]+)\s(?P<Value>.+)" | stats sum(Value) list(Value) AS abc1 by Group  | mvexpand abc1

OR

| makeresults | eval abc="G1 1 G1 5 G1 1 G1 1 G3 3 G3 3 G3 3"  | rex field=abc max_match=0 "(?P<Group>[^\s]+)\s(?P<Value>[^\s]+)" | eval ab=mvzip(Group,Value) | mvexpand ab | rex field=ab max_match=0 "(?P<Group>[^,]+),(?P<Value>.+)" | stats sum(Value) AS Sum list(Value) AS Value by Group | mvexpand Value
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...