Hi
I need to do a sum of all columns into new column
EVNT COL1 COL2 COL3 SUM
1 22 22 22 66
2 1 0 0 1
-paull
Hi
You can try
| makeresults
| eval EVNT=1,COL1=22,COL2=22,COL3=22,SUM=0
| foreach COL*
[ eval SUM = SUM+<<FIELD>>]
| table EVNT,COL1,COL2,COL3,SUM
@paullt12345 ,
Just add |addtotals fieldname=sum
to your search and you get a new sum field
https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/SearchReference/Addtotals
5 years later and I came upon this. This should be the actual, concise answer for OP's question.
Thanks it also works as expected.
Hi
You can try
| makeresults
| eval EVNT=1,COL1=22,COL2=22,COL3=22,SUM=0
| foreach COL*
[ eval SUM = SUM+<<FIELD>>]
| table EVNT,COL1,COL2,COL3,SUM
Thanks...