Sum of two fields

[tej8]

I have two fields "body.response.successfulItemsCount" & "body.successfulItemsCount". I need sum of total of these two fields.

I ran separate queries like this : 1. index= AND | chart sum("body.response.successfulItemsCount") as sum
2. index= AND ** | chart sum("body.successfulItemsCount") as sum

I got accurate result when i run these queries , but how to get total sum of results in one query? I tried this one but not working
index= AND | chart sum("body.response.successfulItemsCount" OR "body.successfulItemsCount") as sum

[whrg]

Hello @tej8,

Try something like this:

your base search
| stats sum("body.response.successfulItemsCount") AS sum1 sum("body.successfulItemsCount") AS sum2
| eval totalsum = sum1 + sum2