## Summary

```
sum(<expression>[,metrics|sources|sourceTags|pointTags|<pointTagKey>])
```

Returns the sum of the set of time series described by the expression.
The results might be computed from real reported values and interpolated values.
Use `rawsum()`

if you don’t need interpolation.

## Parameters

Parameter | Description |
---|---|

expression | Expression describing the set of time series to be summed. |

metrics|sources|sourceTags|pointTags|<pointTagKey> | Optional 'group by' parameter for organizing the time series into subgroups and then returning a sum for each subgroup. Use one or more parameters to group by metric names, source names, source tag names, point tag names, values for a particular point tag key, or any combination of these items. Specify point tag keys by name. |

## Description

The `sum()`

aggregation function adds together the data values at each moment in time, across the time series that are represented by the expression.

By default, `sum()`

produces a single series of sums by aggregating values across all time series. You can optionally group the time series based on one or more characteristics, and obtain a separate series of sums for each group.

If any time series has data gaps, `sum()`

fills them in by interpolation whenever possible.

### Grouping

Like all aggregation functions, `sum()`

returns a single series of results by default. You can include a ‘group by’ parameter to obtain separate subtotals for groups of time series that share common metric names, source names, source tags, point tags, or values for a particular point tag key.
The function returns a separate series of results corresponding to each group.

You can specify multiple ‘group by’ parameters to group the time series based on multiple characteristics. For example, `sum(ts("cpu.cpu*"), metrics, Customer)`

first groups by metric names, and then groups by the values of the `Customer`

point tag.

### Interpolation

If any time series has gaps in its data, Wavefront attempts to fill these gaps with interpolated values before applying the function. A value can be interpolated into a time series only if at least one other time series reports a real data value at the same moment in time.

Within a given time series, an interpolated value is calculated from two real reported values on either side of it.
Sometimes interpolation is not possible–for example, when a new value has not been reported yet in a live-view chart.
In this case, Wavefront finds the last known reported value in the series, and assigns it to any subsequent moment in time for which a real reported data value is present in some other time series. We use the last known reported value only if interpolation can’t occur *and* if the last known reported value has been reported within the last 15% of the query time in the chart window.

You can use `rawsum()`

to suppress interpolation. See Standard Versus Raw Aggregation Functions.

## Examples

**Unaggregated Series**

This chart shows all of the time series described by the expression `ts(~sample.cpu.loadavg.1m)`

. Each time series reports CPU load averages from a particular source associated with particular point tag values.
We will sum these series in different ways in the following examples.

**Example 1: No Filtering, no Grouping**

Here we include all of the time series in the results:

`sum(ts(~sample.cpu.loadavg.1m))`

Summing these series adds their values “vertically” to produce a single series of sums, so the chart shows a single line. For example, the aggregated value at 3:30pm (`22.376`

) is the sum of the individual values reported by each time series at 3:30pm.

**Example 2: Filtering by Source**

Here we filter the time series to include only those reported from `db-*`

servers in the results. We still see a single line, but a different pattern. Notice that the aggregated value at 3:30pm is now `7.112`

, because it is the sum of values from fewer series.

`sum(ts(~sample.cpu.loadavg.1m, source="db-*"))`

**Example 3: Grouping by Point Tag**

Here we not only filter by source, but we also group the results to obtain separate subtotals for each `env`

point tag value. This chart displays one line that sums the series with `env=production`

, and a second line that sums the series with `env=dev`

. This chart allows you to compare the CPU load patterns across the two groups of servers.

`sum(ts(~sample.cpu.loadavg.1m, source="db-*"),env)`

## Caveats

Using `rawsum()`

instead of `sum()`

can significantly improve query performance because `rawsum()`

does not perform interpolation.