How to create a new column in my table showing the sum of FieldA by FieldB?

[akawacz]

HI

My data

Quarter   Type   Amount
2014q1     a      100
2014q1     b      200
2015q2     a      100
2015q2     b      100

I would like to create an additional column with sum for the same quarter.

Expected result

Quarter   Type   Amount  New_column
2014q1     a      100       300
2014q1     b      200       300
2015q2     a      100       200
2015q2     b      100       200

My current search:

index=test |stats(amount) as amount by quarter type

I do not want to use join and append.

Could you help me?

[somesoni2 · Accepted solution]

Try this

your current search | eventstats sum(amount) as New_column by quarter

[akawacz]

That works!! thank you

[ppablo]

Hi @akawacz,

Glad @somesoni2 helped you find your answer 🙂 Please be sure to accept his answer by clicking "Accept" directly below the answer, otherwise this post will show as unresolved. Thanks!

Patrick

[woodcock]

This is not your search; you are missing a function between stats and (amount).

[akawacz]

Yes, good point. Just forgot to put it. i was recreating version of my bigger search that would be better/easier to explain.

[woodcock]

OK, so what is it supposed to be?

[akawacz]

should be sum