How to create a basic query to add all sub processing time for fileprocessing?

[sravankaripe]

Hi,
I have some events which are related to file processing.
each file process have sub process with sub process ID and time taken to complete that sub process.
to know time taken for file process i need to add all sub process times.
my events are like this.

index=ABC source=trxfxfgf.log

Event 1 : myfile.txt sub_process_id: asgr1001 Total Time Taken: 10sec
Event 2 : myfile.txt sub_process_id: shhhtsh1002 Total Time Taken: 20sec.
Event 3 : myfile.txt sub_process_id: shsdthds1003 Total Time Taken: 30sec.
Event 4: myfile.txt sub_process_id: tdhtr1004 Total Time Taken: 40sec.
Event 5 : myfile.txt sub_process_id: rehttr1005 Total Time Taken: 50sec.

i want to display
filename timeTaken

---

myfile.txt 150sec

Please help me with basic query to add all sub process time.

[richgalloway · Accepted solution]

Assuming you already have the fields extracted with the file name in 'filename' and time taken in 'timeTaken' then this should work.

index=ABC source=trxfxfgf.log | stats sum(timeTaken) as TotalTime by filename

[sravankaripe]

Thanks Rich, it helped me a lot