What I am trying to achieve is to display sum of two aggregated fields sum(DiscoverCountOld) as VisitsDiscoveredOld and sum(DiscoverCount) as VisitsDiscovered as a new column instead of those two fields
_source="src" and _collector="collector"
| parse regex "Finished cataloging (?<DiscoverCountOld>\d+) visits for state " nodrop
| parse regex "Finished cataloging visits: Visit count: (?<DiscoverCount>\d+)" nodrop
| parse regex "Finished submitting (?<SubmitCount>\d+) visits for state CO" nodrop
| parse regex "Finished updating status for (?<UpdateCount>\d+) visits for state CO"
| fields DiscoverCountOld,DiscoverCount,SubmitCount,UpdateCount
| timeslice 1d
| sum(DiscoverCountOld) as VisitsDiscoveredOld,sum(DiscoverCount) as VisitsDiscovered, sum(SubmitCount) as VisitsSubmitted, sum(UpdateCount) as VisitsUpdated group by _timeslice
| fillmissing timeslice(1d)
| sort by _timeslice asc
Here is the answer found:
_source="_source" and _collector="-collector"
| parse regex "Finished cataloging (?<DiscoverCountOld>\d+) visits for state " nodrop
| parse regex "Finished cataloging visits: Visit count: (?<DiscoverCount>\d+)" nodrop
| parse regex "Finished submitting (?<SubmitCount>\d+) visits for state CO" nodrop
| parse regex "Finished updating status for (?<UpdateCount>\d+) visits for state CO"
| timeslice 1d
| sum(DiscoverCountOld) as VisitsDiscoveredOld,sum(DiscoverCount) as VisitsDiscoveredNew, sum(SubmitCount) as VisitsSubmitted, sum(UpdateCount) as VisitsUpdated group by _timeslice
| VisitsDiscoveredOld+VisitsDiscoveredNew as VisitsDiscovered
| fields _timeslice,VisitsDiscovered,VisitsSubmitted,VisitsUpdated
| fillmissing timeslice(1d)
| sort by _timeslice asc