sum up several fields with integer counts to one

[mhornste]

Hi,

I have several fields which should be summed up to one count. I tried the following but the field is not showing up (even with fields + fieldname).

index=otcs  sourcetype=OtcsSummaryTimings FunctionAction="doc.fetch" OR  FunctionAction="doc.Fetch" OR FunctionAction="fetch"   | eval sumFetch=doc.Fetch+doc.fetch+fetch | timechart span=7d count by FunctionAction

The result only shows the fields without the calculated one. I unfortunately can't attach files (karma).

Thanks!

[FrankVl]

So, you have 3 slightly different types of events, each having the fetch value in a different field?

An eval statement like that will not work at all, if some of the fields in it are missing, they will not automagically evaluate to 0 and still make the summation work.

I would solve this by renaming the 3 different fields such that they have the same name in each event, and then simply doing a stats sum() on that.

Also not sure what exactly you try to do with that timechart, as that doesn't reference the sumFetch field in any way???

Even though you cannot attach files, you can still upload screenshots somewhere and put the URL in your question, right?

[p_gurav]

Can you try something like:

 index=otcs  sourcetype=OtcsSummaryTimings FunctionAction="doc.fetch" OR  FunctionAction="doc.Fetch" OR FunctionAction="fetch"  
| stats count(eval(FunctionAction="doc.fetch")) AS count_doc_fetch  count(eval(FunctionAction="doc.Fetch")) AS count_doc_Fetch count(eval(FunctionAction="fetch")) AS count_fetch by _time | eval sumFecth='count_doc_fetch'+'count_fetch'+'count_doc_Fetch'