# Aggregate based on different timerange
**URL:** https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065
**Category:** Kibana
**Created:** [May 3, 2016, 2:37pm UTC](https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065 "2016-05-03T14:37:05Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@shaharmor](https://discuss.elastic.co/u/shaharmor)
#### Post date: [May 3, 2016, 2:37pm UTC](https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065/1 "2016-05-03T14:37:05Z")
Hi,
I'm having trouble figuring out how to graph a complex query in Kibana.
My issue is as follow:
I have 2 servers, each has a different number of clients connected to it.
Lets assume server1 has 100 clients connected and server2 has 200 clients connected.
I want to graph the total # of clients connected to all my servers over time.
What i'm doing now is send the # of clients connected per server to ES every second and then when i go to kibana i can graph the SUM of the clients number over all the documents per second.
The problem starts when i increase the time range to more than 1s, the SUM is now summing all the documents within the bigger timeframe which is obviously not the correct number.
So if i have something like this:
```auto
08:00 - server1 - 100
08:00 - server2 - 200
08:01 - server1 - 100
08:01 - server2 - 200
08:02 - server1 - 100
08:02 - server2 - 200
08:03 - server1 - 100
08:03 - server2 - 200
```
If i SUM per second, i will get:
```auto
08:00 - 300
08:01 - 300
08:02 - 300
08:03 - 300
```
But if i SUM per 2 seconds, i will get:
```auto
08:00 - 600 // incorrect, should be 300
08:02 - 600 // incorrect, should be 300
```
How can i still do this?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 4, 2016, 4:57am UTC](https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065/2 "2016-05-04T04:57:28Z")
> [@shaharmor](#):
>
> 08:00 - server1 - 100
> 08:00 - server2 - 200
> 08:01 - server1 - 100
> 08:01 - server2 - 200
That's 600 though because that's the sum of all the values in that 2 second bucket.
Why do you think it should be 300?
---
### Author:  [@shaharmor](https://discuss.elastic.co/u/shaharmor)
#### Post date: [May 4, 2016, 7:56am UTC](https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065/3 "2016-05-04T07:56:35Z")
Sorry, maybe i didn't explain it good enough.
I want to know how many distinct connections i have across all the servers.
The value that each doc has (100 & 200 in the above example) is the total number of concurrent connections connected to the server.
So if i look at server1, he never had 200 concurrent connections connected to it. At most he had 100.
When i try to look at what was the maximum number i can do it with a MAX aggregation on a per server basis.
But if i want to combine the MAX aggregation across all servers i need to SUM, but only the MAX values per timerange.
Does that makes more sense?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 4, 2016, 8:03am UTC](https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065/4 "2016-05-04T08:03:29Z")
Yeah that makes sense.
I don't think KB can do that natively to be honest, but maybe someone else has an idea.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:54pm UTC](https://discuss.elastic.co/t/aggregate-based-on-different-timerange/49065/5 "2017-07-06T13:54:27Z")