Easy max of count not working in gauge (TimeSeries)


Probably something I didn't understand well with time series.
Wanted to display in gauge the number of port down since 1w, so a count of documents filtered by type:tcp AND up:false.
Seems like I can see the graph, but when I switch to gauge, it always displays 0.

Should I be able to do:

  • Count document type:tcp AND up:false
  • And do a max on that to see it in gauge? When aggregating in max I can't see the previous document.count

Big thanks for any help!

Have you tried adding an Overall Max (pipeline sibling agg) to the series and then choosing the count aggregation as the metric? ON the time series visualization that will draw a flat line for the max of the series and on the gauge I think it will display the number you're looking for.

Thanks so much @simianhacker, I used Count -> Overall Sum(sibling pipe Agg) of metric (count) and I got the result I wanted!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.