https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580525#M202246 <P>Hi,&nbsp;<BR /><BR />Thank you for your input. I tried you suggestion but I get the same error as when I daisy-chain them.</P> Mon, 10 Jan 2022 21:50:05 GMT splunk3341 2022-01-10T21:50:05Z https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580504#M202240 <P>Hello,<BR /><BR />I am working with the timechart command on my following query and I am running into some problems.<BR /><BR />I am trying to compute:&nbsp;<BR />timechart span=15m sum(ofAField) as sumOfField, avg(sumOfField) as avgOfField by task<BR /><BR />My problem with this one is that when I run it. I get the correct output for the first task but the out for the rest of the task are wrong. I am assuming that for the rest of the tasks only the sum portion of the time chart query is being calculated and not the avg. For background context there are about 11 different task this time chart is being grouped by.&nbsp;<BR /><BR /></P><P>TIA</P> Mon, 10 Jan 2022 18:27:32 GMT https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580504#M202240 splunk3341 2022-01-10T18:27:32Z https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580507#M202242 <P>I'm 99% sure you can't daisy-chain expressions like that - at least not successfully.&nbsp; Try computing the sum and average in different commands, something like this:</P><LI-CODE lang="markup">| bin span=15m _time | stats sum(ofAField) as sumOfField by _time,task | timechart span=15m avg(sumOfField) as avgOfField by task</LI-CODE> Mon, 10 Jan 2022 18:40:39 GMT https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580507#M202242 richgalloway 2022-01-10T18:40:39Z https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580525#M202246 <P>Hi,&nbsp;<BR /><BR />Thank you for your input. I tried you suggestion but I get the same error as when I daisy-chain them.</P> Mon, 10 Jan 2022 21:50:05 GMT https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580525#M202246 splunk3341 2022-01-10T21:50:05Z https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580530#M202249 <P>Please tell us more about the error.&nbsp; What results are expected and what do you get?</P> Tue, 11 Jan 2022 01:04:54 GMT https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580530#M202249 richgalloway 2022-01-11T01:04:54Z https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580546#M202255 <P>If I understand you correctly, you are getting the sum of "ofAField" in a 15 minute period. In that case, what exactly should the average show for that 15 minute period - I am assuming you are looking for a flat line of the average across your time range.</P><P>In that case, you would do this</P><LI-CODE lang="markup">| makeresults count=1000 | streamstats c | eval _time=_time-(c*10) | eval task=mvindex(split("taskA,taskB,taskC,taskD", ","), random() % 4) | eval ofAfield=random() % 100 | timechart span=15m sum(ofAfield) as sumofAfield by task | eventstats avg(*) as avg_*</LI-CODE><P>The last two lines are what you want, i.e. you first take the sum of 'ofAfield" and then use eventstats to compute the average</P><P>Then using a bar chart with an overlay of the average fields you can produce this sort of output - is this what you wanted?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bowesmana_0-1641880742594.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17505iD6E9BE776E1EFA0E/image-size/medium?v=v2&amp;px=400" role="button" title="bowesmana_0-1641880742594.png" alt="bowesmana_0-1641880742594.png" /></span></P><P>&nbsp;</P> Tue, 11 Jan 2022 05:59:15 GMT https://community.splunk.com/t5/Splunk-Search/time-chart-only-computing-the-first-part-of-the-calculation/m-p/580546#M202255 bowesmana 2022-01-11T05:59:15Z