Splunk Search

How to sum two fields?

vince_iw
Explorer

I am attempting to eval a new field, from two other fields:

 

 

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| eval total_errors='4XXError'+'5XXError'

 

 

 

when I come to stat them out:

 

 

| stats last(4XXError), last(5XXError), last(total_errors) by api_name, http_method, url

 

 

 

the total_errors column is just blank:

vince_iw_0-1658315465525.png

 

where am i going wrong? 

 

also why does 4XXError need to be single-quoted? is it because it starts with a number?

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| stats last(4XXError) as 4XXError, last(5XXError) as 5XXError by api_name, http_method, url
| eval total_errors='4XXError'+'5XXError'

You search seems to imply that the 4XXError (stats) events are different events to the 5XXError, so you need to use stats by ... to gather them into single events so you can do the arithmetic

View solution in original post

vince_iw
Explorer

excellent, thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| stats last(4XXError) as 4XXError, last(5XXError) as 5XXError by api_name, http_method, url
| eval total_errors='4XXError'+'5XXError'

You search seems to imply that the 4XXError (stats) events are different events to the 5XXError, so you need to use stats by ... to gather them into single events so you can do the arithmetic

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...