# Get visualization of missing data

**URL:** <https://discuss.elastic.co/t/get-visualization-of-missing-data/251285>\
**Category:** Kibana\
**Created:** [October 7, 2020, 2:20pm UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285 "2020-10-07T14:20:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mistrhanky](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\
**Post date:** [October 7, 2020, 2:20pm UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285/1 "2020-10-07T14:20:45Z")

</div>

I have data that comes in from many different sources(syslog hosts, ossec, etc). I need to visualize in a data table any sources that have been recieved in the last month but have NOT been recieved in the last 48 hours(To understand if I have a potential problem with a failing data source). I am only interested in data that has not appeared in the last 48 hours though, if it was recently received in that window, I do not want to show it.

I have tried a number of strategies including scripted fields and such but I think my real problem is just not understanding kibana enough to build the visualization. I feel like this must be a simple task, but I admit to being stumped. How can I get a visualization with events where the latest timestamp is not newer than 48 hours?

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [October 14, 2020, 10:48am UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285/2 "2020-10-14T10:48:08Z")

</div>

Hi, probably one way to do that is:

- create a data table in TSVB
- pick `Entire time range` on the `Data timerange mode` in the Panel options.
- Select the last month as time interval
- specify the group by related to your sources field
- keep the current count metric aggregation
- on the options panel of your count metric aggregation apply a filter: like `@timestamp >= now-48h`

This should basically get all the sources available in the last month but counts the number of documents only for the documents with a timestamp greater than now - 48h. In the table, will appear all your sources with no data in the last 48 hours at 0.  
You can also specify a text color if the metric is at zero

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2020, 10:48am UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285/3 "2020-11-11T10:48:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.