Splunk Search

how to saving various sums in a variable?

renanprado96
Path Finder

how to saving various sums in a variable for future search?
I know it gives you to put a sum on a varivavel, but several I can not
Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...

View solution in original post

0 Karma

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...
0 Karma

MuS
Legend

... and put those SPL commands into a saved search which does summary indexing http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Usesummaryindexing and you have it stored for future searches .... if this is what the user wants?

0 Karma

somesoni2
Revered Legend

Could you provide more details with examples? What is your current search/output and what do you expect?

Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...