Splunk Search

how to saving various sums in a variable?

renanprado96
Path Finder

how to saving various sums in a variable for future search?
I know it gives you to put a sum on a varivavel, but several I can not
Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...

View solution in original post

0 Karma

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...
0 Karma

MuS
SplunkTrust
SplunkTrust

... and put those SPL commands into a saved search which does summary indexing http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Usesummaryindexing and you have it stored for future searches .... if this is what the user wants?

0 Karma

somesoni2
Revered Legend

Could you provide more details with examples? What is your current search/output and what do you expect?

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...