# Calculating the sum of latest values - Timelion/Kibana

**URL:** https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894
**Category:** Kibana
**Tags:** timelion
**Created:** [December 1, 2017, 8:37am UTC](https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894 "2017-12-01T08:37:47Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![emil.mirzayev](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)
#### Post date: [December 1, 2017, 8:37am UTC](https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894/1 "2017-12-01T08:37:47Z")

</div>

Hey there!  
I am new to ELK stack. I have the data of measurements of different devices by time. Every 15 min, I get new values per each device (and value in t is always bigger or equal to value in t-1). What I want to do, is to calculate the sum of the latest values of each device within a given time period. Is it possible to do in Timelion or Kibana directly? My data structure is like this:  
timestamp; device\_id; value  
timestamp; device\_id; value  
timestamp+15min; device\_id; value  
timestamp+15min; device\_id; value

Edit: Docouments are in one index named "measurements".

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [December 1, 2017, 10:07pm UTC](https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894/2 "2017-12-01T22:07:57Z")

</div>

Hi Emil,

My first thought would be a Data Table visualization like this;  
I used Metric = max bytes, but you would use your `value` I think.  
And then I split rows with a Terms aggregation by extension.raw, but you would use your `device_id` for that.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48bd4f8ac0bb7b3cc2e3fba2c92e3a33a489a1cb.png)

Let me know if that works for you.

Regards,  
Lee

---

<div class="post-metadata">

### Author: ![emil.mirzayev](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)
#### Post date: [December 4, 2017, 8:45am UTC](https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894/3 "2017-12-04T08:45:05Z")

</div>

Hi Lee,  
looks like it is what I need. I think after having lots of devices, showing only the top -n- won't be the best possibility. Is it possible also to remove the limitation? I can put it to 100 or 1000, but it would be great to know how to remove it

EDIT: Is it also possible to have timestamp field in the table? I want to show the value graph by time per each device?

best,  
Emil

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [December 5, 2017, 11:04pm UTC](https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894/4 "2017-12-05T23:04:19Z")

</div>

In Management \> Advanced Settings there's this setting;

metrics:max\_buckets  
The maximum number of buckets a single datasource can return  
default value is 2000

You could increase that, but you might have performance issues or use a lot of memory on your Elasticsearch node(s) and/or your Kibana server.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2018, 11:04pm UTC](https://discuss.elastic.co/t/calculating-the-sum-of-latest-values-timelion-kibana/109894/5 "2018-01-02T23:04:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
