sum fields in same event

[Joe Rizzo]

I need to sum fields by other fields in the same event.

Here is an example event:

_time                                somefieldname   somefieldvalue

6/26/10 3:09:23.000 AM     A                       1

                                        A                       1

                                        B                       2

                                        B                       2

How could I sum the values in somefieldvalue by somefieldname, then graph the sum.  IE '| timechart span=1m avg(somefieldvalue) by somefield.'

For this event on the timechart A would equal to 2 and B would equal to 4.

I'm at a loss.  Any help is appreciated.

Thanks,

Joe

[Michael Wilde]

Have you considered using " | makemv" to turn that event in to a multi-value field, so you end up with a=1 a=2 b=2 b=2 and then do an | eval a = a+a | eval b = b + b

[Joe Rizzo]

Thanks for the reply.

I ended up splitting the event into multiple events using split. Then I could use stats and timechart as expected.

Thanks,
Joe