Dashboards & Visualizations

## How can I structure the search to sum up the values into one single value for plotting?

Explorer

I have some data: Which is retrieved by the following search:

``````index="INDEX"
| timechart span=7d AVG(FIELD1) by FIELD2
| streamstats AVG window=75
| table _time AVG*
``````

How can I structure that search to sum up the values into one single value for plotting?

Thanks!

Tags (4)
1 Solution
Explorer

Solved!

``````index="INDEX"
| timechart span=12h sum(FIELD1) as FIELD1 by
| streamstats window=30 AVG
| table _time AVG*
``````

It's not a very pretty answer (forces it to calculate each individual point by span=12h) but it gets the job done.

Explorer

Solved!

``````index="INDEX"
| timechart span=12h sum(FIELD1) as FIELD1 by
| streamstats window=30 AVG
| table _time AVG*
``````

It's not a very pretty answer (forces it to calculate each individual point by span=12h) but it gets the job done. SplunkTrust

Give this a try

``````index="INDEX"
| timechart span=7d AVG(FIELD1) as AVG
| streamstats AVG window=75
| table _time AVG*
``````
Explorer

Edit: This worked, I just had to change the span down to only take into account one data collection time, otherwise it would sum for the week.

Explorer

I think I'm trying to change the way I'm looking at the data. Instead of summing the FIELD2's FIELD1 values by date, I'm modifying the base search and summing the FIELD1 by Date.

This search results in an average across all FIELD2 values, somehow. SplunkTrust

Give this a try

`````` index="INDEX"
| bucket span=7d _time
| stats avg(FIELD1) as AVG by _time FIELD2
| stats avg(AVG) as AVG by _time
``````  