How can i sum fields to have the total in a new field ?
For example, i have a field called (BytesReceivedPerSec) and i would have the sum of this field for all the event (in realtime)
I tried accum BytesReceivedPersec AS bytesrcvdtotal but i doesn't do a total sum of all the bytes received.
Have you an idea ?
Thank you very much 🙂
It works perfectly
my search exactly :
host=hp-dev index="main"| stats sum(BytesReceivedPersec) AS octetsrecus sum(BytesSentPersec) AS octetsenvoyes | eval octetsrecusMo=octetsrecus / 1000000 | eval octetsenvoyesMo=octetsenvoyes / 1000000