Easy max of count not working in gauge (TimeSeries)

[gregbk (greg)]

Hello,

Probably something I didn't understand well with time series.
Wanted to display in gauge the number of port down since 1w, so a count of documents filtered by type:tcp AND up:false.
Seems like I can see the graph, but when I switch to gauge, it always displays 0.

Should I be able to do:

• Count document type:tcp AND up:false
• And do a max on that to see it in gauge? When aggregating in max I can't see the previous document.count

Big thanks for any help!
Greg

[simianhacker (Chris Cowan)]

Have you tried adding an Overall Max (pipeline sibling agg) to the series and then choosing the count aggregation as the metric? ON the time series visualization that will draw a flat line for the max of the series and on the gauge I think it will display the number you're looking for.

[gregbk (greg)]

Thanks so much @simianhacker, I used Count -> Overall Sum(sibling pipe Agg) of metric (count) and I got the result I wanted!