Splunk Search

how to saving various sums in a variable?

renanprado96
Path Finder

how to saving various sums in a variable for future search?
I know it gives you to put a sum on a varivavel, but several I can not
Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...

View solution in original post

0 Karma

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...
0 Karma

MuS
Legend

... and put those SPL commands into a saved search which does summary indexing http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Usesummaryindexing and you have it stored for future searches .... if this is what the user wants?

0 Karma

somesoni2
Revered Legend

Could you provide more details with examples? What is your current search/output and what do you expect?

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...