https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430083#M168422 <P>Assuming you already have the fields extracted with the file name in 'filename' and time taken in 'timeTaken' then this should work.</P> <PRE><CODE>index=ABC source=trxfxfgf.log | stats sum(timeTaken) as TotalTime by filename </CODE></PRE> Mon, 09 Jul 2018 18:20:44 GMT richgalloway 2018-07-09T18:20:44Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430082#M168421 <P>Hi,<BR /> I have some events which are related to file processing.<BR /> each file process have sub process with sub process ID and time taken to complete that sub process.<BR /> to know time taken for file process i need to add all sub process times. <BR /> my events are like this.</P> <P>index=ABC source=trxfxfgf.log</P> <P>Event 1 : myfile.txt sub_process_id: asgr1001 Total Time Taken: 10sec<BR /> Event 2 : myfile.txt sub_process_id: shhhtsh1002 Total Time Taken: 20sec.<BR /> Event 3 : myfile.txt sub_process_id: shsdthds1003 Total Time Taken: 30sec.<BR /> Event 4: myfile.txt sub_process_id: tdhtr1004 Total Time Taken: 40sec.<BR /> Event 5 : myfile.txt sub_process_id: rehttr1005 Total Time Taken: 50sec.</P> <P>i want to display<BR /> filename timeTaken</P> <HR /> <P>myfile.txt 150sec</P> <P>Please help me with basic query to add all sub process time.</P> Tue, 29 Sep 2020 20:21:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430082#M168421 sravankaripe 2020-09-29T20:21:58Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430083#M168422 <P>Assuming you already have the fields extracted with the file name in 'filename' and time taken in 'timeTaken' then this should work.</P> <PRE><CODE>index=ABC source=trxfxfgf.log | stats sum(timeTaken) as TotalTime by filename </CODE></PRE> Mon, 09 Jul 2018 18:20:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430083#M168422 richgalloway 2018-07-09T18:20:44Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430084#M168423 <P>Thanks Rich, it helped me a lot</P> Mon, 09 Jul 2018 18:53:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-basic-query-to-add-all-sub-processing-time-for/m-p/430084#M168423 sravankaripe 2018-07-09T18:53:33Z