How to calculate Total of two values

[aditsss]

Hi all,

Can someone guide me how can we calculate two fields.

I have two fields in my lookup file OPEN and Closed. I need their total.

 How can we do that.

[manjunathmeti · Accepted solution]

You can use stats command. If you want to count the number of events,

| stats count(OPEN) as open_count count(Closed) as closed_count | eval total_count = open_count + closed_count

If you want to get the sum of the field numerical values,

| stats sum(OPEN) as open_sum sum(Closed) as closed_sum | eval total = open_sum + closed_sum

Refer to this page for more examples: https://docs.splunk.com/Documentation/SCS/current/SearchReference/StatsCommandExamples#1._Calculate_...

If this reply helps you, an upvote/like would be appreciated.