https://community.splunk.com/t5/Splunk-Search/Timechart-sum-search-query/m-p/540746#M153030 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227186">@jboustead</a>&nbsp;</P><P>How is the value of xxx derived? Do you see the same issue using another numeric field with a known derivation, e.g. sum(_time)?</P><P>You may be receiving different events each time the search executes, but it's not possible to verify that without an understanding of your deployment.</P> Sun, 21 Feb 2021 22:02:17 GMT tscroggins 2021-02-21T22:02:17Z https://community.splunk.com/t5/Splunk-Search/Timechart-sum-search-query/m-p/535164#M151263 <P>I am using the same timechart search query:</P><P>'search</P><P>| timechart span=1d sum(xxx)"</P><P>when I set the time range picker to yesterday preset I get a different value to when I change the time to 'week to date' and view the stats table the value for yesterday - could there be a reason for this?</P> Fri, 08 Jan 2021 09:28:46 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-sum-search-query/m-p/535164#M151263 jboustead 2021-01-08T09:28:46Z https://community.splunk.com/t5/Splunk-Search/Timechart-sum-search-query/m-p/540746#M153030 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227186">@jboustead</a>&nbsp;</P><P>How is the value of xxx derived? Do you see the same issue using another numeric field with a known derivation, e.g. sum(_time)?</P><P>You may be receiving different events each time the search executes, but it's not possible to verify that without an understanding of your deployment.</P> Sun, 21 Feb 2021 22:02:17 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-sum-search-query/m-p/540746#M153030 tscroggins 2021-02-21T22:02:17Z