How can I structure the search to sum up the values into one single value for plotting?

[splunk_question]

I have some data:

Which is retrieved by the following search:

index="INDEX"
| timechart span=7d AVG(FIELD1) by FIELD2
| streamstats AVG window=75
| table _time AVG*

How can I structure that search to sum up the values into one single value for plotting?

Thanks!

[splunk_question · Accepted solution]

Solved!

index="INDEX" 
| timechart span=12h sum(FIELD1) as FIELD1 by
| streamstats window=30 AVG
| table _time AVG*

It's not a very pretty answer (forces it to calculate each individual point by span=12h) but it gets the job done.

[somesoni2]

Give this a try

index="INDEX"
 | timechart span=7d AVG(FIELD1) as AVG
 | streamstats AVG window=75
 | table _time AVG*

[splunk_question]

Edit: This worked, I just had to change the span down to only take into account one data collection time, otherwise it would sum for the week.

[splunk_question]

I think I'm trying to change the way I'm looking at the data. Instead of summing the FIELD2's FIELD1 values by date, I'm modifying the base search and summing the FIELD1 by Date.

This search results in an average across all FIELD2 values, somehow.

[somesoni2]

Give this a try

 index="INDEX"
| bucket span=7d _time 
| stats avg(FIELD1) as AVG by _time FIELD2
| stats avg(AVG) as AVG by _time