https://community.splunk.com/t5/Splunk-Search/How-to-sum-same-field-twice/m-p/447401#M126828 <P>Hi @TylerJVitale ,</P> <P>This sounds like a good place to use eventstats.</P> <PRE> | stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION | eventstats sum(VOLUME) as TOTAL_VOLUME</PRE> Mon, 24 Jun 2019 19:05:58 GMT jnudell_2 2019-06-24T19:05:58Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-same-field-twice/m-p/447400#M126827 <P>I want to be able to sum the same field in order to create 2 different fields so that I can compare the Volume by application to the total volume. Right now this is the structure of my search:</P> <PRE><CODE>| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION | join [ search |&nbsp; stats sum(VOLUME) as TOTAL_VOLUME | where TOTAL_VOLUME &gt; 1 |&nbsp; head 1 ] </CODE></PRE> <P>Is there a more efficient way I can do this so that I don't have to use the "join" part and go through the whole index twice?</P> Mon, 24 Jun 2019 18:57:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-same-field-twice/m-p/447400#M126827 TylerJVitale 2019-06-24T18:57:45Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-same-field-twice/m-p/447401#M126828 <P>Hi @TylerJVitale ,</P> <P>This sounds like a good place to use eventstats.</P> <PRE> | stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION | eventstats sum(VOLUME) as TOTAL_VOLUME</PRE> Mon, 24 Jun 2019 19:05:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-same-field-twice/m-p/447401#M126828 jnudell_2 2019-06-24T19:05:58Z