How do I sum the result of an aggregation and present it in a table?

[eeijlar]

I would like to take the results of this query, namely the values:
3683
3676
3574
3530
3706
3695
3663
3530
3586
3567
Sum them together, which would give: 36210, and display them in a table. I can't seem to figure out the table piece. I have tried just doing a straight sum of kubernetes.pod.cpu.usage.nanocores but that gives a different result, as kubernetes.pod.cpu.usage.nanocores is not an average, it's just a point-in-time value. I need to get a sum of a set of accumulated averages. The table I have looks like this:

I have also tried to just take the average, but then I need to multiply that by the number of pods. I can't seem to find a metric for that which works.

I am using Kibana 7.17.7

[stephenb (Stephen Brown)]

Which Exact VIZ is that...

You have to do what is known as a Series Agg - SUM

Under that first Average AGG and another Agg

Series Agg of type Sum of the Average above

That says Sum the Values for the Series and in this case the Series is the Value for Each Pod... for each Time Bucket i,e. add the values in each bucket to get a sum for each time bucket

Leave still the group by term kubernetes.pod.name

The Table Part in TSVB can be hard why don't you try the Line First...

[eeijlar]

Hi Stephen,

Thanks for your reply! It's the Table of of the same visual:

I tried Overall Sum (there is no option for Sum to aggregate the previous collection). It still just shows the average:

I think because there is only now a single value to sum up. The individual buckets have been accumulated into a single value.

I can't use Series Agg:

[stephenb (Stephen Brown)]

So the non-table version would look like this, Yeah done think TSVB table is going to work...
I think Lens Might, but I don't have a 7.17. to test with

And here is just a metric that could be over the whole time frame or the last bucket

[eeijlar]

Thanks for your help @stephenb That explains it. Lens will work but there is no option to do the manipulations I need using a Bucket Script.

[Marco_Liberati]

@eeijlar that bucket script seems quite easy to be translated into a Lens formula.

[eeijlar]

That one is straightforward but I have another one that I am not sure if I can do in Lens. I will look into it further. Thanks @Marco_Liberati