Sum of Field values

[_gkollias]

Hi All,

I'm using a query to get the total count of individual fields.
Here is the search and chart being displayed:

index=eis_continuous_integration sourcetype=eisci
| bucket _time span=1d
| stats count as totalType by Group, Type, _time
|eval Date=_time
|convert timeformat = "%m/%d/%Y" ctime (Date)
| table Date, Group, Type, totalType

_time Group Type totalType
12/16/13 EG DEPLOY 16
12/16/13 EG POST-DEPLOY 8
12/16/13 EG PRE-DEPLOY 4
12/16/13 EG ROLLBACK 2

What I'd like is the sum of totalType by Group--this way when more groups are added I will have the sum of Type by each Group. So it would look like:

date group totalCount
12/16 EG 30
12/16 CG X...etc

How can I add up the totalTypes column to obtain the results above? I've tried playing around with sum, addtotals, etc. but have had no luck.

Thanks!

[somesoni2 · Accepted solution]

Try this

index=eis_continuous_integration sourcetype=eisci | bucket _time span=1d | stats count as totalType, values(Type) as Types by Group, _time |eval Date=_time |convert timeformat = "%m/%d/%Y" ctime (Date) | table Date, Group, Types, totalType

OR

index=eis_continuous_integration sourcetype=eisci | bucket _time span=1d | stats count as totalType by Group, Type, _time |eval Date=_time |convert timeformat = "%m/%d/%Y" ctime (Date) | status sum(totalType) as totalType by Group,Date

Another options

index=eis_continuous_integration sourcetype=eisci | bucket _time span=1d | stats count as countType by Group, Type, _time |eval Date=_time |convert timeformat = "%m/%d/%Y" ctime (Date) 
| table Date, Group, Type, countType | eventstats sum(countType ) as totalType by Group, Date

[_gkollias]

You're a genius.. Thank you!

[somesoni2]

Try this

index=eis_continuous_integration sourcetype=eisci | timechart span=1d count as totalTypes by Group | rename _time as Date |convert timeformat="%m/%d/%Y" ctime(Date)

[_gkollias]

Thanks! This worked:
index=eis_continuous_integration sourcetype=eisci
| bucket _time span=1d
| stats count as totalType, values(Type) as Types by Group, _time
| eval Date=_time
| convert timeformat="%m/%d/%Y" ctime(Date)

If I wanted to put this in a column chart, how could I make it so I could match the count with what Group it is associated with (i.e. same color)? To try and paint the picture-- a column chart with count on the left(y-axis), date on the x-axis, and then have Group on the right. Is that possible?