Calculates the sum for a field over a set of events. Result is returned in a field named _sum.

ParameterTypeRequiredDefaultDescription
asstringoptional[a]_sum Name of output field.
field[b]stringrequired  Field to extract a number from and sum over.

[a] Optional parameters use their default value unless explicitly set

[b] The argument name field can be omitted.

Omitted Argument Names

The argument name for field can be omitted; the following forms of this function are equivalent:

logscale
sum("value")

and:

logscale
sum(field="value")

sum() Examples

How many bytes did our webserver send per minute

logscale
bucket(function=sum(bytes_sent))