Splunk Search
Highlighted

stats sum?

Communicator

From my list of field in Splunk, I have three fields with numeric values that I would like to add together and assign the total to a field called "TotalThreatCount".

i.e. - CriticalSeverity = 50 + MediumSeverity = 25 + LowSeverity = 25 AS TotalThreat_Count (100)

What would the stats command that would work best here.

I have tried stats sum(CriticalSeverity, MediumSeverity, LowSeverity) AS TotalThreat_Count, but I am getting a blank value for that field.

Tags (1)
0 Karma
Highlighted

Re: stats sum?

Builder

I think you want to use eval here. Something like

... | eval TotalThreatCount=CriticalSeverity + MediumSeverity + LowSeverity | table host, TotalThreat_Count

should work.

0 Karma