Splunk Search

How to sum same field twice

TylerJVitale
Explorer

I want to be able to sum the same field in order to create 2 different fields so that I can compare the Volume by application to the total volume. Right now this is the structure of my search:

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION | 
join [ search |  stats sum(VOLUME) as TOTAL_VOLUME | where TOTAL_VOLUME > 1 |  head 1 ]

Is there a more efficient way I can do this so that I don't have to use the "join" part and go through the whole index twice?

0 Karma
1 Solution

jnudell_2
Builder

Hi @TylerJVitale ,

This sounds like a good place to use eventstats.

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION
| eventstats sum(VOLUME) as TOTAL_VOLUME

View solution in original post

0 Karma

jnudell_2
Builder

Hi @TylerJVitale ,

This sounds like a good place to use eventstats.

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION
| eventstats sum(VOLUME) as TOTAL_VOLUME
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...