sum([value: numeric or duration]+) -> value

Sums numeric values or durations. In aggregate or window() form with a single argument, null inputs are skipped and the result type follows the argument type, except that summing numeric may widen to float64 to avoid fixed-decimal surprises in the pipeline. With multiple arguments in one call, the function is the scalar sum of those expressions; if any argument is null, the scalar result is null.

Domain

This is an aggregate function (aggregates rows over a group in aggregate verbs).

This is a window function (calculates over a group of multiple input rows using windowing).

Categories

• Aggregate
• Numeric
• Time
• Window

Examples

statsby total_bytes:sum(bytes), group_by(host)

Aggregates per-host byte totals with sum while skipping null byte fields in the grouped aggregate form.

make_col parts:sum(read_ms, write_ms, wait_ms)

Sums three duration columns on each row using the scalar sum overload, which becomes null if any component is null.