Sum last count over servers and time chart

[n0cturne]

Hello,

I have 5 Servers. Every server has an actual count of user sessions. I want them to sum up, without loosing the trend funcion in the single value chart. 

This is my actual query:

index=ascrm sourcetype=jmx NumUiSessions=* host IN (z1il0095*,z1il0096*,z1il0097*,z1il0098*)
| stats latest(NumUiSessions) as latest_NumUiSessions by host
| stats sum(latest_NumUiSessions) AS UISessions

 Could anyone give me a clou?

Best regards

Benjamin

[n0cturne]

I want to trend against the value x hours ago. I have a time picker with token. This time token shoul be used to define x.

[ITWhisperer]

Something like this?

index=ascrm sourcetype=jmx NumUiSessions=* host IN (z1il0095*,z1il0096*,z1il0097*,z1il0098*)
| bin _time span=1h
| stats latest(NumUiSessions) as latest_NumUiSessions by host _time
| streamstats sum(latest_NumUiSessions) AS UISessions by _time

[ITWhisperer]

What are you trending against, because you currently only have one value remaining?