Splunk Search

How to Sum(column1, column2, column3) as column4?

abnderby
Engager

I need to know how to Sum(CreatedSD?,CreatedBD,CreatedLOD) as CreatedTotal

Login, Document and Loan Counts High Level

SERVICE

UserLogins DocumentUploads CreatedSD? CreatedBD CreatedLOD CreatedTotal
Prod-310 1          
Prod-330 2098 145 17 20 2  
Prod-340 1553 184 3 9 6  
      20 29 8  
  3652 329 40 58 16  

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use a separate eval command to add the sums.

| stats count as UserLogins, sum("CreatedSD?") as "CreatedSD?", sum(CreatedBD) as CreatedBD, sum(CreatedLOD) as CreatedLOD by SERVICE
| eval CreatedTotal = 'CreatedSD?', + CreatedBD + CreatedLOD

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

abnderby
Engager

Thank you very much for the reply, normally I play the senior T-SQL developer for MS SQL dev team. Manager wants to dual role me with splunk reports etc. So this is sort of kind of familiar etc. Under to gun of course to fix old stuff and make new stuff.

while waiting on reply I trudge forward and found this


| stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source
| addtotals Created* fieldname="CreatedTotal" col=t labelfield=SERVICE label="Totals"
| rename source as SERVICE

this worked, I did try your snippet as well since you took the time to write it up, but i get "No results found." did i do something wrong?

| stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source
| eval CreatedTotal = CreatedSD + CreatedBD + CreatedLOD
| rename source as SERVICE

 

 

richgalloway
SplunkTrust
SplunkTrust

It's hard to say what may have gone wrong without seeing the data, but when stats returns no results it's usually because one of the groupBy fields (source, in this case) is null.

---
If this reply helps you, Karma would be appreciated.

somesoni2
Revered Legend

If your column names (Created*)  are dynamic but they all start with string "Created", you can use foreach command like this to get the total.

Your current search creating table
| eval CreatedTotal=0
| foreach Created* [| eval CreatedTotal=CreatedTotal + '<<FIELD>>']

richgalloway
SplunkTrust
SplunkTrust

Use a separate eval command to add the sums.

| stats count as UserLogins, sum("CreatedSD?") as "CreatedSD?", sum(CreatedBD) as CreatedBD, sum(CreatedLOD) as CreatedLOD by SERVICE
| eval CreatedTotal = 'CreatedSD?', + CreatedBD + CreatedLOD

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...