Calculates the sum for a field over a set of events. Result is returned in a field named _sum.

Function Traits: Aggregate

ParameterTypeRequiredDefaultDescription
asstringoptional_sum Name of output field.
field[a]stringrequired  Field to extract a number from and sum over.

[a] The argument name field can be omitted.

The parameter name for field can be omitted; the following forms are equivalent:

logscale
sum("value")

and:

logscale
sum(field="value")

sum() Examples

How many bytes did our webserver send per minute

logscale
bucket(function=sum(bytes_sent))