# Filtering based on a calculated metric

**URL:** <https://discuss.elastic.co/t/filtering-based-on-a-calculated-metric/178269>\
**Category:** Kibana\
**Created:** [April 24, 2019, 2:16pm UTC](https://discuss.elastic.co/t/filtering-based-on-a-calculated-metric/178269 "2019-04-24T14:16:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![matoro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matoro/32/61791_2.png) [@matoro](https://discuss.elastic.co/u/matoro)\
**Post date:** [April 24, 2019, 2:16pm UTC](https://discuss.elastic.co/t/filtering-based-on-a-calculated-metric/178269/1 "2019-04-24T14:16:54Z")

</div>

Hi all, I am trying to create a simple data table with the goal of seeing "unusual" domains. By "unusual," I mean "seen within a recent short time period (say, past 24h - this would be hardcoded) without having been seen in the current time filter (say, 90d)".

I have looked at a couple different ways to approach this, but so far I have not been able to figure out how to identify a way to create this data table. My first thought was to create two metrics: one, the count of the domain; two, the max of the timestamp of the last seen packet. Then, I could sort on count first and lastPacket second, getting the most recently seen domains with only one hit. However, according to [Allow sorting on multiple fields · Issue #696 · elastic/kibana](https://github.com/elastic/kibana/issues/696) , support for sorting based on multiple criteria is not available yet. So, I continued looking.

My second thought was to create a second metric - the count of hits in the shorter time period. Then, filter only on rows where this value is greater than zero and the inverse filter is zero. However, according to [How to apply filter to individual metric in Kibana?](https://discuss.elastic.co/t/how-to-apply-filter-to-individual-metric-in-kibana/121832) you cannot apply a filter to only a single metric.

Lastly I turned to the visual builder since it supposedly has more features. However, when I tried to add a metric for the last seen packet like I had in the Data Table builder, it wouldn't show up. In fact, none of the date fields would show up including @timestamp.

Can somebody point me in the direction of the tool or tools I can use to create such a visualization and the approach I should take?

---

<div class="post-metadata">

**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\
**Post date:** [April 24, 2019, 7:34pm UTC](https://discuss.elastic.co/t/filtering-based-on-a-calculated-metric/178269/2 "2019-04-24T19:34:02Z")

</div>

@timroes any thoughts on this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2019, 7:46pm UTC](https://discuss.elastic.co/t/filtering-based-on-a-calculated-metric/178269/3 "2019-05-22T19:46:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.