Hello Splunkers,
I have two different sourcetypes that can be grouped by a unique id where one sourcetype has some numerical value and another ends with transaction "END" such as below:
sourcetype1
unique_ID, field_A
a, 10
b, 20
c, 5
a, 20
c, 30
sourcetype2
unique_ID, field_B
a, END
b, END
c, END
I would like to calculate the sum of field_A between "END" status for unique_ID.
What I have done so far is:
sourcetype=sourcetype1 OR sourcetype=sourcetype2 | transaction unique_ID startswith="END"
Any help is welcomed.
Thanks in advance.
104K