topic Re: Sum integer-named variables? in Splunk Search

Sum integer-named variables?

ctallarico20 — Wed, 05 Jun 2013 14:01:21 GMT

Hi, so given a log including TwoHundred=5 it's pretty easy to make a timechart with a sum(TwoHundred) command. However, my logs are http responses, so they look like 200=5 and the sum(200) does not return results on the graph. Any idea of something that will tell splunk that the 200 is intended as a string?

Re: Sum integer-named variables?

gfuente — Wed, 05 Jun 2013 14:17:14 GMT

Hello

Try with: sum($200$)

Regards

Re: Sum integer-named variables?

ctallarico20 — Wed, 05 Jun 2013 14:21:12 GMT

This is along the lines of what i was looking for, however just like sum(200), nothing is displayed on the timechart:( it turns up in the search if i look at the table though!

Re: Sum integer-named variables?

gfuente — Mon, 28 Sep 2020 14:02:36 GMT

And with a rename like:
...| rename $200$ as http_status | timechart sum(http_status)

Re: Sum integer-named variables?

ctallarico20 — Wed, 05 Jun 2013 14:28:32 GMT

hmm i really like the ideas you're coming up with but again that one produced no chart:/

Re: Sum integer-named variables?

ctallarico20 — Wed, 05 Jun 2013 14:32:34 GMT

also if you don't mind me asking, what does $ do?