topic Re: How to create a new column in my table showing the sum of FieldA by FieldB? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222152#M65315 <P>Yes, good point. Just forgot to put it. i was recreating version of my bigger search that would be better/easier to explain.</P> Tue, 15 Sep 2015 15:23:12 GMT akawacz 2015-09-15T15:23:12Z How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222149#M65312 <P>HI</P> <P>My data</P> <PRE><CODE>Quarter Type Amount 2014q1 a 100 2014q1 b 200 2015q2 a 100 2015q2 b 100 </CODE></PRE> <P>I would like to create an additional column with sum for the same quarter. </P> <P>Expected result</P> <PRE><CODE>Quarter Type Amount New_column 2014q1 a 100 300 2014q1 b 200 300 2015q2 a 100 200 2015q2 b 100 200 </CODE></PRE> <P>My current search:</P> <PRE><CODE>index=test |stats(amount) as amount by quarter type </CODE></PRE> <P>I do not want to use join and append.</P> <P>Could you help me?</P> Tue, 15 Sep 2015 12:29:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222149#M65312 akawacz 2015-09-15T12:29:21Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222150#M65313 <P>This is not your search; you are missing a function between <CODE>stats</CODE> and <CODE>(amount)</CODE>.</P> Tue, 15 Sep 2015 15:20:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222150#M65313 woodcock 2015-09-15T15:20:35Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222151#M65314 <P>Try this</P> <PRE><CODE>your current search | eventstats sum(amount) as New_column by quarter </CODE></PRE> Tue, 15 Sep 2015 15:23:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222151#M65314 somesoni2 2015-09-15T15:23:04Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222152#M65315 <P>Yes, good point. Just forgot to put it. i was recreating version of my bigger search that would be better/easier to explain.</P> Tue, 15 Sep 2015 15:23:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222152#M65315 akawacz 2015-09-15T15:23:12Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222153#M65316 <P>OK, so what is it supposed to be?</P> Tue, 15 Sep 2015 15:31:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222153#M65316 woodcock 2015-09-15T15:31:29Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222154#M65317 <P>should be sum</P> Tue, 15 Sep 2015 16:36:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222154#M65317 akawacz 2015-09-15T16:36:54Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222155#M65318 <P>That works!! thank you</P> Tue, 15 Sep 2015 16:39:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222155#M65318 akawacz 2015-09-15T16:39:37Z Re: How to create a new column in my table showing the sum of FieldA by FieldB? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222156#M65319 <P>Hi @akawacz,</P> <P>Glad @somesoni2 helped you find your answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Please be sure to accept his answer by clicking "Accept" directly below the answer, otherwise this post will show as unresolved. Thanks!</P> <P>Patrick</P> Tue, 15 Sep 2015 19:09:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-column-in-my-table-showing-the-sum-of-FieldA/m-p/222156#M65319 ppablo 2015-09-15T19:09:27Z