Splunk Search

How to sum same field twice

TylerJVitale
Explorer

I want to be able to sum the same field in order to create 2 different fields so that I can compare the Volume by application to the total volume. Right now this is the structure of my search:

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION | 
join [ search |  stats sum(VOLUME) as TOTAL_VOLUME | where TOTAL_VOLUME > 1 |  head 1 ]

Is there a more efficient way I can do this so that I don't have to use the "join" part and go through the whole index twice?

0 Karma
1 Solution

jnudell_2
Builder

Hi @TylerJVitale ,

This sounds like a good place to use eventstats.

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION
| eventstats sum(VOLUME) as TOTAL_VOLUME

View solution in original post

0 Karma

jnudell_2
Builder

Hi @TylerJVitale ,

This sounds like a good place to use eventstats.

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION
| eventstats sum(VOLUME) as TOTAL_VOLUME
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>