Splunk Search

How to sum two fields?

vince_iw
Explorer

I am attempting to eval a new field, from two other fields:

 

 

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| eval total_errors='4XXError'+'5XXError'

 

 

 

when I come to stat them out:

 

 

| stats last(4XXError), last(5XXError), last(total_errors) by api_name, http_method, url

 

 

 

the total_errors column is just blank:

vince_iw_0-1658315465525.png

 

where am i going wrong? 

 

also why does 4XXError need to be single-quoted? is it because it starts with a number?

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| stats last(4XXError) as 4XXError, last(5XXError) as 5XXError by api_name, http_method, url
| eval total_errors='4XXError'+'5XXError'

You search seems to imply that the 4XXError (stats) events are different events to the 5XXError, so you need to use stats by ... to gather them into single events so you can do the arithmetic

View solution in original post

vince_iw
Explorer

excellent, thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| stats last(4XXError) as 4XXError, last(5XXError) as 5XXError by api_name, http_method, url
| eval total_errors='4XXError'+'5XXError'

You search seems to imply that the 4XXError (stats) events are different events to the 5XXError, so you need to use stats by ... to gather them into single events so you can do the arithmetic

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...