https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184937#M53257 <P>Like this:</P> <PRE><CODE> my_search ... | eval total_bytes = exact(val_1 + val_2) | stats sum(total_bytes) by source destination </CODE></PRE> Tue, 30 Jun 2015 21:43:47 GMT woodcock 2015-06-30T21:43:47Z https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184936#M53256 <P>Hi,</P> <P>I am having a tough time in creating overall sum and aggregate sum. Here is my issue:</P> <P>I have multiple values between client-server:</P> <PRE><CODE>source destination client_to_server_bytes server_to_client_bytes A -- B 10 12 A -- B 10 10 A -- C 50 30 C -- D 15 15 c -- D 10 10 </CODE></PRE> <P>I want to create a table with addition of two values in all occurrences. And final value would have addition of all the additions:</P> <PRE><CODE>A -- B 42 A -- C 80 C -- D 50 </CODE></PRE> <P>To get first addition I did:</P> <PRE><CODE>my_search ... | eval total_bytes = exact(val_1 + val_2) | table source destination total_bytes </CODE></PRE> <P>This correctly gave me following result:</P> <PRE><CODE>A -- B 22 A -- B 20 ...and so on </CODE></PRE> <P>Now how do I combine them to form a single result?</P> Tue, 30 Jun 2015 21:39:58 GMT https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184936#M53256 shrirangphadke 2015-06-30T21:39:58Z https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184937#M53257 <P>Like this:</P> <PRE><CODE> my_search ... | eval total_bytes = exact(val_1 + val_2) | stats sum(total_bytes) by source destination </CODE></PRE> Tue, 30 Jun 2015 21:43:47 GMT https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184937#M53257 woodcock 2015-06-30T21:43:47Z https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184938#M53258 <P>It was easy! I am really dumb.. Anyways Thanks for your help !!</P> Tue, 30 Jun 2015 21:49:54 GMT https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184938#M53258 shrirangphadke 2015-06-30T21:49:54Z https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184939#M53259 <P>So am I but Splunk makes even dummies look brilliant!</P> Tue, 30 Jun 2015 21:54:41 GMT https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184939#M53259 woodcock 2015-06-30T21:54:41Z https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184940#M53260 <P>very true !</P> Tue, 30 Jun 2015 22:06:32 GMT https://community.splunk.com/t5/Splunk-Search/sum-of-all-the-fields-and-aggregate-sum/m-p/184940#M53260 shrirangphadke 2015-06-30T22:06:32Z