sum (comp) ↗

Use the sum() function to compute the sum of all values of a specified numeric field across all rows in each group within the comp stage. This is equivalent to the SQL SUM aggregate function.

Syntax

| comp sum(<field>) [by <group_field1>, <group_field2>, ...] [as <alias>]

Parameters

Name Type Required Description
field numeric Yes The numeric field whose values will be summed.
group_field any No One or more fields to group the results by. If omitted, all rows are treated as a single group.
alias string No An alias for the output field. If not specified, the output field name defaults to sum_<field>.

Returns

Type: numeric

Description: The sum() function returns the total sum of all non-NULL values of the specified field within each group. Returns NULL if all values in the group are NULL. Returns 0 if the group is empty.

Usage notes

  • Data types: The sum function only works with numeric fields.
  • Null handling: NULL values are ignored in the computation.
  • No grouping: When used without a by clause, the function returns the sum across all rows.
  • Multiple aggregations: Can be combined with other aggregation functions in the same comp stage.
  • Overflow: For very large datasets with large values, be aware of potential numeric overflow.

Examples

Example 1: Total bytes sent per host

Goal: Compute the total bytes sent for each host.

XQL code:

dataset = xdr_data
| comp sum(bytes_sent) by agent_hostname as total_bytes_sent

Explanation: The sum() function adds up all bytes_sent values for each unique agent_hostname, returning the total bytes sent per host.

Output:

AGENT_HOSTNAME TOTAL_BYTES_SENT
workstation-1 1048576
workstation-2 524288

Example 2: Total events across all data

Goal: Compute the total sum of alert severities across all events.

XQL code:

dataset = xdr_data
| comp sum(alert_severity) as total_severity

Explanation: Without a by clause, the sum() function computes the total of all alert_severity values across the entire dataset.

Output:

TOTAL_SEVERITY
342

Example 3: Sum with multiple aggregations

Goal: Compute total bytes sent and received along with event count per host.

XQL code:

dataset = xdr_data
| comp sum(bytes_sent) as total_sent, sum(action_network_bytes_received) as total_received, count(*) as event_count by agent_hostname

Explanation: This query combines multiple sum() calls with count() in a single comp stage to provide a comprehensive traffic summary per host.

Output:

AGENT_HOSTNAME TOTAL_SENT TOTAL_RECEIVED EVENT_COUNT
workstation-1 1048576 2097152 150
workstation-2 524288 1048576 85