I have a search that based on a lookup that is pulling names and totals over the course of a 24 hour period or week based on time. How can I sum each column without having to sum every field individually?
( (callingPartyGroup="00581" OR originalCalledPartyGroup="00581" OR finalCalledPartyGroup="00581") )
| lookup groups number as number output name group subgroup
| search ( group="00581" )
| timechart dc(callId) by name
I could get it by running a | sum("Tony Freeman") as "Tony Freeman" sum("Andrea Cook" as "Andrea Cook" etc etc but is there an easier way to do that?