How to get Sum of two fields from different searches?

[Techie]

Hi -

I would like to join and sum the results and output

The searches:

index=test_index sourcetype="test_source"  className=export | table message.totalExportedProfileCounter

index=test_index sourcetype="test_source"  className=export | table message.exportedRecords

From above both searches I am looking to add message.totalExportedProfileCounter, message.exportedRecords. For a given call only one of the above search shows up.

I am looking for message.totalExportedProfileCounter + message.exportedRecords

Thanks in advance!

Thanks.

[ITWhisperer]

Calculations can be done with fields in the same event.

index=test_index sourcetype="test_source"  className=export
| eval total = message.totalExportedProfileCounter + message.exportedRecords

If these fields do not have values in the same event, you need to use something like stats to correlate different events into the same event. For this you need a common field value between events to correlate them by.

[Techie]

@ITWhisperer Thanks for the reply,

I tried below individually for getting sum of all records for each event type

index=test_index sourcetype="test_source"  className=export | stats sum(message.totalExportedProfileCounter) as Total_number_of_exported_profiles 

index=test_index sourcetype="test_source"  className=export | stats sum(message.exportedRecords) as Total_number_of_exported_profiles 

Above queries run just fine by themselves but I am more interested to add both these results into one.

Also the common field that you were asking for can be message.type=export_job which is available in both events.

[ITWhisperer · Accepted solution]

Is this what you mean?

index=test_index sourcetype="test_source"  className=export
| stats sum(message.totalExportedProfileCounter) as Total_number_of_exported_profiles sum(message.exportedRecords) as Total_number_of_exported_records
| eval total = Total_number_of_exported_profiles + Total_number_of_exported_records

[Techie]

This is not helping.

Total_number_of_exported_profiles or Total_number_of_exported_records is showing up but not sum of them. See below screenshot.

[ITWhisperer]

If

index=test_index sourcetype="test_source"  className=export
| stats sum(message.totalExportedProfileCounter) as Total_number_of_exported_profiles

give you a result, and

index=test_index sourcetype="test_source"  className=export
| stats sum(message.exportedRecords) as Total_number_of_exported_records

also gives you a result, then

index=test_index sourcetype="test_source"  className=export
| stats sum(message.totalExportedProfileCounter) as Total_number_of_exported_profiles sum(message.exportedRecords) as Total_number_of_exported_records

should give you two results which can be added together. Please recheck your searches.

[Techie]

Looks like the final sum is not calculated when one of the results is empty. If both are available then the total is populated correctly. In my case either one of them is present. Any idea how to calculate sum in this case?

| eval total = Total_number_of_exported_profiles + Total_number_of_exported_records

[ITWhisperer]

| fillnull value=0 Total_number_of_exported_profiles Total_number_of_exported_records
| eval total = Total_number_of_exported_profiles + Total_number_of_exported_records

[Techie]

This helped. Thanks @ITWhisperer