Splunk Search

Sum of two fields

tej8
New Member

I have two fields "body.response.successfulItemsCount" & "body.successfulItemsCount". I need sum of total of these two fields.

I ran separate queries like this : 1. index= AND | chart sum("body.response.successfulItemsCount") as sum
2. index= AND ** | chart sum("body.successfulItemsCount") as sum

I got accurate result when i run these queries , but how to get total sum of results in one query? I tried this one but not working
index= AND | chart sum("body.response.successfulItemsCount" OR "body.successfulItemsCount") as sum

Tags (1)
0 Karma

whrg
Motivator

Hello @tej8,

Try something like this:

your base search
| stats sum("body.response.successfulItemsCount") AS sum1 sum("body.successfulItemsCount") AS sum2
| eval totalsum = sum1 + sum2
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...