stats sum?

[efelder0]

From my list of field in Splunk, I have three fields with numeric values that I would like to add together and assign the total to a field called "Total_Threat_Count".

i.e. - Critical_Severity = 50 + Medium_Severity = 25 + Low_Severity = 25 AS Total_Threat_Count (100)

What would the stats command that would work best here.

I have tried stats sum(Critical_Severity, Medium_Severity, Low_Severity) AS Total_Threat_Count, but I am getting a blank value for that field.

[cphair]

I think you want to use eval here. Something like

... | eval Total_Threat_Count=Critical_Severity + Medium_Severity + Low_Severity | table host, Total_Threat_Count

should work.