Splunk Search

how to saving various sums in a variable?

renanprado96
Path Finder

how to saving various sums in a variable for future search?
I know it gives you to put a sum on a varivavel, but several I can not
Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...

View solution in original post

0 Karma

woodcock
Esteemed Legend

Create sums within an event with eval like this:

... | eval newSum = field1 + field2 ....

Create sums across events with stats like this:

... | stats sum(field1) sum(field2) ...
0 Karma

MuS
SplunkTrust
SplunkTrust

... and put those SPL commands into a saved search which does summary indexing http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Usesummaryindexing and you have it stored for future searches .... if this is what the user wants?

0 Karma

somesoni2
Revered Legend

Could you provide more details with examples? What is your current search/output and what do you expect?

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...