Can you help me sum the data in the following field?

[maheshsat]

Hi Team,

I have PATA field which needs to do sum of PATA field, am using below command where should add PATA to get sum of PATA field

index=pass  source="test" |eval DATE = YEAR."-".PERIOD| fields DATE | stats count by DATE

2018-10-24 14:43:50.556, S_DATE="201208", SCENARIO="Actual", YEAR="2016", PERIOD="Feb", VIEW="YTD", ENTITY="109", ENTITY_DESC="Test Canada Inc.", MARKET="Canada", ACCOUNT="922002", ACCOUNT_DESC="922002 - Employee Activity Food Bev", INTER_ENTITY="[ICP None]", VALUE="[Parent Total]", RC="21102", SUBACCOUNT="000000", INTER_RC="000000", PRODUCT="000000", CUSTOM5="USD_FUNC_Total", DATA_TYPE="Total_Late", PATA="179.03919201"

[Vijeta]

Try this-

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE, PATA | stats count ,sum(PATA) AS Total_PATA by DATE

[harsmarvania57 · Accepted solution]

If you want count and sum both, try below query

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE, PATA | stats count, sum(PATA) AS Total_PATA by DATE

[maheshsat]

Thanks Its woking, Appreciate for your help

[harsmarvania57]

Great that your problem is solved 🙂

[maheshsat]

yes i did your command , but count field is missing , and getting two fields Date and PATA

[maheshsat]

Thanks for quick reply

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE | stats count by DATE

getting below output

Date Count
2016-Apr 6000
2016-Aug 1000
2016-Dec 1229

My requirement

Date Count PATA
2016-Apr 6000

2016-Aug 1000
2016-Dec 1229

It should sum of PATA data with year and month wise , visible in PATA field

your command does not add count field , hence it is not working

[harsmarvania57]

Have you tried to run query which I have provided ? You are still doing stats count instead of stats sum(PATA).... as I mentioned in previous comment.

[harsmarvania57]

Hi,

Can you please try below query ?

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE, PATA | stats sum(PATA) AS Total_PATA by DATE