From my list of field in Splunk, I have three fields with numeric values that I would like to add together and assign the total to a field called "TotalThreatCount".
i.e. - CriticalSeverity = 50 + MediumSeverity = 25 + LowSeverity = 25 AS TotalThreat_Count (100)
What would the stats command that would work best here.
I have tried stats sum(CriticalSeverity, MediumSeverity, LowSeverity) AS TotalThreat_Count, but I am getting a blank value for that field.
I think you want to use eval here. Something like
... | eval TotalThreatCount=CriticalSeverity + MediumSeverity + LowSeverity | table host, TotalThreat_Count