How to sum two fields?

[vince_iw]

I am attempting to eval a new field, from two other fields:

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| eval total_errors='4XXError'+'5XXError'

when I come to stat them out:

| stats last(4XXError), last(5XXError), last(total_errors) by api_name, http_method, url

the total_errors column is just blank:

vince_iw_0-1658315465525.png

where am i going wrong? 

also why does 4XXError need to be single-quoted? is it because it starts with a number?

[vince_iw]

excellent, thanks!

[ITWhisperer · Accepted solution]

Try it like this

| eval 4XXError=if(metric_name="4XXError", statistic_value, null()) 
| eval 5XXError=if(metric_name="5XXError", statistic_value, null()) 
| stats last(4XXError) as 4XXError, last(5XXError) as 5XXError by api_name, http_method, url
| eval total_errors='4XXError'+'5XXError'

You search seems to imply that the 4XXError (stats) events are different events to the 5XXError, so you need to use stats by ... to gather them into single events so you can do the arithmetic