Give this a try. index="8s_perf_mon" Machine= 5002 Position!=0 | timechart span=12h values(eval(if(Efficiency==0, null(),Efficiency))) by Position | streamstats window=100 sum count(*) as "(*" | foreach "(*" [eval "avg<<FIELD>>)"='sum<<FIELD>>)'/'<<FIELD>>'] | fields - (* sum* Calculating count and sum separately in streamstats, with count being shown only for not null values. Foreach to calculate average by diving sum by count of non-nulls. ... View more

Your original query, before streamstats, was a timechart query with _time as first column (for x-axis) and 1-8 as trend columns. Using | table AVG* you're removing the _time field as well, hence the chart visualization is treating first column AVG(1) as x-axis value. Just include the _time as well in your table command index="8s_perf_mon" Machine= 5001 Position>=1 AND Position<=8 | timechart span=12h values(eval(if(Efficiency=0, null(),Efficiency))) by Position | streamstats AVG |table _time AVG* ... View more