Sum integer-named variables?

[ctallarico20]

Hi, so given a log including TwoHundred=5 it's pretty easy to make a timechart with a sum(TwoHundred) command. However, my logs are http responses, so they look like 200=5 and the sum(200) does not return results on the graph. Any idea of something that will tell splunk that the 200 is intended as a string?

[gfuente · Accepted solution]

Hello

Try with: sum($200$)

Regards

[ctallarico20]

also if you don't mind me asking, what does $ do?

[ctallarico20]

hmm i really like the ideas you're coming up with but again that one produced no chart:/

[gfuente]

Ok

And with a rename like:
...| rename $200$ as http_status | timechart sum(http_status)

??

[ctallarico20]

This is along the lines of what i was looking for, however just like sum(200), nothing is displayed on the timechart:( it turns up in the search if i look at the table though!