To my understanding, single value uses the first value of the result table.
However, how do I build the search for the single value panel to show the total and sparkline underneath to show average?
Also, how do I change the trend indicator to compare current total and total an hour ago?
If you'd like to see the total as the "main" single value, you'll have to forfeit the use of timechart (since this will be time-based), which will then forfeit the sparkline and trend indicator. I think you best bet may be to separate this into two different single value visualizations. One single value visualization for the running total, and a separate one where you show the 15 min average, which will can include the trend from an hour ago.
I'm trying to achieve something very similar (without the trend part). I can show the total using addcoltotals, however, then the sparkline is messed up. Then, when I have a nice sparkline, then the total is nowhere to be shown... Did you come to a solution on this matter?