How to Sum(column1, column2, column3) as column4?

[abnderby]

I need to know how to Sum(CreatedSD?,CreatedBD,CreatedLOD) as CreatedTotal

Login, Document and Loan Counts High Level
SERVICE	UserLogins	DocumentUploads	CreatedSD?	CreatedBD	CreatedLOD	CreatedTotal
Prod-310	1
Prod-330	2098	145	17	20	2
Prod-340	1553	184	3	9	6
			20	29	8
	3652	329	40	58	16

[abnderby]

Thank you very much for the reply, normally I play the senior T-SQL developer for MS SQL dev team. Manager wants to dual role me with splunk reports etc. So this is sort of kind of familiar etc. Under to gun of course to fix old stuff and make new stuff.

while waiting on reply I trudge forward and found this

| stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source
| addtotals Created* fieldname="CreatedTotal" col=t labelfield=SERVICE label="Totals"
| rename source as SERVICE

this worked, I did try your snippet as well since you took the time to write it up, but i get "No results found." did i do something wrong?

| stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source
| eval CreatedTotal = CreatedSD + CreatedBD + CreatedLOD
| rename source as SERVICE

[richgalloway]

It's hard to say what may have gone wrong without seeing the data, but when stats returns no results it's usually because one of the groupBy fields (source, in this case) is null.

[somesoni2]

If your column names (Created*)  are dynamic but they all start with string "Created", you can use foreach command like this to get the total.

Your current search creating table
| eval CreatedTotal=0
| foreach Created* [| eval CreatedTotal=CreatedTotal + '<<FIELD>>']

[richgalloway · Accepted solution]

Use a separate eval command to add the sums.

| stats count as UserLogins, sum("CreatedSD?") as "CreatedSD?", sum(CreatedBD) as CreatedBD, sum(CreatedLOD) as CreatedLOD by SERVICE
| eval CreatedTotal = 'CreatedSD?', + CreatedBD + CreatedLOD