https://community.splunk.com/t5/Splunk-Search/How-to-sum-a-field-with-a-by-clause-in-pivot-UI/m-p/189137#M54489 <P>index=_internal per_sourcetype_thruput series!=splunkd | eval gb=kb/1024/1024 | timechart span=1d useother=f sum(gb) by series</P> <P>So I have a created a root datamodel of index=_internal source=/opt/splunk/var/log/splunk/metrics.log*</P> <P>and a child object of per_sourcetype_thruput series!=splunkd</P> <P>and an eval field for gb that is kb/1024/1024</P> <P>I'm getting the right fields, but for the field gb field I have no sum function with or without putting a by clause split. What do I have to do to sum a field with a by clause in pivot UI?</P> Mon, 28 Sep 2020 17:22:31 GMT mjones414 2020-09-28T17:22:31Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-a-field-with-a-by-clause-in-pivot-UI/m-p/189137#M54489 <P>index=_internal per_sourcetype_thruput series!=splunkd | eval gb=kb/1024/1024 | timechart span=1d useother=f sum(gb) by series</P> <P>So I have a created a root datamodel of index=_internal source=/opt/splunk/var/log/splunk/metrics.log*</P> <P>and a child object of per_sourcetype_thruput series!=splunkd</P> <P>and an eval field for gb that is kb/1024/1024</P> <P>I'm getting the right fields, but for the field gb field I have no sum function with or without putting a by clause split. What do I have to do to sum a field with a by clause in pivot UI?</P> Mon, 28 Sep 2020 17:22:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-a-field-with-a-by-clause-in-pivot-UI/m-p/189137#M54489 mjones414 2020-09-28T17:22:31Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-a-field-with-a-by-clause-in-pivot-UI/m-p/189138#M54490 <P>Make sure you set the type of that field to <CODE>Number</CODE> rather than <CODE>String</CODE>.</P> Thu, 21 Aug 2014 07:44:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-a-field-with-a-by-clause-in-pivot-UI/m-p/189138#M54490 martin_mueller 2014-08-21T07:44:10Z