Splunk Search

How to sum two fields ?

Explorer

Hello,

How can i sum fields to have the total in a new field ?
For example, i have a field called (BytesReceivedPerSec) and i would have the sum of this field for all the event (in realtime)

I tried accum BytesReceivedPersec AS bytesrcvdtotal but i doesn't do a total sum of all the bytes received.

Have you an idea ?

Thanks

Tags (1)
0 Karma
1 Solution

Motivator

Try the following search:

index=Your_Index | stats sum(BytesReceivedPerSec) AS bytes_total

View solution in original post

0 Karma

Explorer

Thank you very much 🙂

It works perfectly

my search exactly :

host=hp-dev index="main"| stats sum(BytesReceivedPersec) AS octetsrecus sum(BytesSentPersec) AS octetsenvoyes | eval octetsrecusMo=octetsrecus / 1000000 | eval octetsenvoyesMo=octetsenvoyes / 1000000

0 Karma

Motivator

Glad to help 🙂

0 Karma

Motivator

Try the following search:

index=Your_Index | stats sum(BytesReceivedPerSec) AS bytes_total

View solution in original post

0 Karma