topic sum up several fields with integer counts to one in Splunk Search

sum up several fields with integer counts to one

mhornste — Thu, 12 Apr 2018 06:47:06 GMT

Hi,

I have several fields which should be summed up to one count. I tried the following but the field is not showing up (even with fields + fieldname).

index=otcs  sourcetype=OtcsSummaryTimings FunctionAction="doc.fetch" OR  FunctionAction="doc.Fetch" OR FunctionAction="fetch"   | eval sumFetch=doc.Fetch+doc.fetch+fetch | timechart span=7d count by FunctionAction

The result only shows the fields without the calculated one. I unfortunately can't attach files (karma).

Thanks!

Re: sum up several fields with integer counts to one

p_gurav — Thu, 12 Apr 2018 06:55:34 GMT

Can you try something like:

 index=otcs  sourcetype=OtcsSummaryTimings FunctionAction="doc.fetch" OR  FunctionAction="doc.Fetch" OR FunctionAction="fetch"  
| stats count(eval(FunctionAction="doc.fetch")) AS count_doc_fetch  count(eval(FunctionAction="doc.Fetch")) AS count_doc_Fetch count(eval(FunctionAction="fetch")) AS count_fetch by _time | eval sumFecth='count_doc_fetch'+'count_fetch'+'count_doc_Fetch'

Re: sum up several fields with integer counts to one

FrankVl — Thu, 12 Apr 2018 07:57:23 GMT

So, you have 3 slightly different types of events, each having the fetch value in a different field?

An eval statement like that will not work at all, if some of the fields in it are missing, they will not automagically evaluate to 0 and still make the summation work.

I would solve this by renaming the 3 different fields such that they have the same name in each event, and then simply doing a stats sum() on that.

Also not sure what exactly you try to do with that timechart, as that doesn't reference the sumFetch field in any way???

Even though you cannot attach files, you can still upload screenshots somewhere and put the URL in your question, right?