topic How to Sum(column1, column2, column3) as column4? in Splunk Search

How to Sum(column1, column2, column3) as column4?

abnderby — Mon, 10 Apr 2023 17:06:59 GMT

I need to know how to Sum(CreatedSD?,CreatedBD,CreatedLOD) as CreatedTotal

Login, Document and Loan Counts High Level
SERVICE	UserLogins	DocumentUploads	CreatedSD?	CreatedBD	CreatedLOD	CreatedTotal
Prod-310	1
Prod-330	2098	145	17	20	2
Prod-340	1553	184	3	9	6
			20	29	8
	3652	329	40	58	16

Re: How to Sum(column1, column2, column3) as column4?

richgalloway — Mon, 10 Apr 2023 18:54:06 GMT

Use a separate eval command to add the sums.

| stats count as UserLogins, sum("CreatedSD?") as "CreatedSD?", sum(CreatedBD) as CreatedBD, sum(CreatedLOD) as CreatedLOD by SERVICE | eval CreatedTotal = 'CreatedSD?', + CreatedBD + CreatedLOD

Re: How to Sum(column1, column2, column3) as column4?

somesoni2 — Mon, 10 Apr 2023 19:00:05 GMT

If your column names (Created*) are dynamic but they all start with string "Created", you can use foreach command like this to get the total.

Your current search creating table | eval CreatedTotal=0 | foreach Created* [| eval CreatedTotal=CreatedTotal + '<<FIELD>>']

Re: How to Sum(column1, column2, column3) as column4?

abnderby — Mon, 10 Apr 2023 19:12:36 GMT

Thank you very much for the reply, normally I play the senior T-SQL developer for MS SQL dev team. Manager wants to dual role me with splunk reports etc. So this is sort of kind of familiar etc. Under to gun of course to fix old stuff and make new stuff.

while waiting on reply I trudge forward and found this

| stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source
| addtotals Created* fieldname="CreatedTotal" col=t labelfield=SERVICE label="Totals"
| rename source as SERVICE

this worked, I did try your snippet as well since you took the time to write it up, but i get "No results found." did i do something wrong?

| stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source
| eval CreatedTotal = CreatedSD + CreatedBD + CreatedLOD
| rename source as SERVICE

Re: How to Sum(column1, column2, column3) as column4?

richgalloway — Mon, 10 Apr 2023 19:50:20 GMT

It's hard to say what may have gone wrong without seeing the data, but when stats returns no results it's usually because one of the groupBy fields (source, in this case) is null.