How can i calculate sum of values from different hosts

[mishaaaaaaaaaa]

Hi, splunkers!
I have 4 hosts, and i need to culculate total sum of values contained in each event
In other words i have:
host1: value1
host2: value2
host3: value3
host4: value4
and i need to calculate value1+value2+value3+value4 and display it in Single Value splunk visualisation
i try to do it like this:
index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4
| timechart max(value) by host as "Total Max Value"

but i have max value from all hosts displayed

[chrisyounger]

hi @mishaaaaaaaaaa

Try this index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats sum(value) as "Total Max Value"

Good luck!

[mishaaaaaaaaaa]

i tryed to do it like you suggested, but in this case i have sum of values by all period
and i need value by the current moment

[chrisyounger]

Can you just change the timepicker to be "last 15 minutes"? Does that do what you want?

[mishaaaaaaaaaa]

I need to see statistic by 2 hour but display only current value at the moment but not a sum of values since the system have been started

[chrisyounger]

ok I understand now. Try this index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats latest(value) as "Latest Value"

[mishaaaaaaaaaa]

No, this doesn't work
i found something like this, but it also works bad

index=myIndex | bucket _time span=2h | stats max($module$.metric.sampleCount) as metricValueFromAllHosts by host, _time | timechart span=2h sum(metricValueFromAllHosts)

this solution correctly display the sum of metric.sampleCount from all hasts, but doesn't display statistic like if i had metric.sampleCount=16 two hours ago and now i have 32, it shows 0 always

[chrisyounger]

OK last try. What about index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats latest(value) as latest by host | stats sum(latest)

[mishaaaaaaaaaa]

No, this doesn't work too
Your solution calculates only sum of metrics from all hosts at the current moment and dysplay them
But i need sum of metrics from all hosts at the current moment and statistic like from earliest bound of period till latest bound of period we have increase sum of metrics on 16 for example, so in the earliest bound we had 12 and in latest we have 28
And single value visualisation allows us to display such statistic

[vishaltaneja070]

@mishaaaaaaaaaa

Try something like this:

    index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats sum(value) as latest by host | stats sum(latest)

[mishaaaaaaaaaa]

Thanks a lot for everyone for your answers, the problem was because my metric accumulates to previous values.
In my case this solution works correct:
index=someIndex | bucket _time | stats max(metric.sampleCount) as metricValueFromAllHosts by host, _time | timechart sum(metricValueFromAllHosts)