# How to show max count of yesterday with 1 hour time bucket?

**URL:** <https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097>\
**Category:** Kibana\
**Created:** [November 17, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097 "2017-11-17T09:23:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [November 17, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/1 "2017-11-17T09:23:23Z")

</div>

Hi,

I am watching the data of yesterday (complete day).  
No I have the task to show the max event count per hour for the timespan set.

How do I do it? How can I return the max value of multiple buckets?

My current workaround is the following:  
table visualization

- date histogram by 1 hour interval
- show only one line
- sort by count descending

Is there any better way than that? So that I can get the number directly without having the overhead of the paging UI?

Thanks, Andreas

---

<div class="post-metadata">

**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\
**Post date:** [November 17, 2017, 4:36pm UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/2 "2017-11-17T16:36:52Z")

</div>

Hi @asp,

> [@asp](#):
>
> show the max event count

When you say `count`, are you referring to the total number of documents in the index for the given timestamp? Are you referring to a custom field for your dataset?

I ask because it seems you can simply remove the `show only one line` and see the information you want (unless I'm misunderstanding).

---

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [November 20, 2017, 8:57am UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/3 "2017-11-20T08:57:40Z")

</div>

I set "yesterday" in time picker.

by setting date histogram to 1 hour, I will get following as example:  
Time Count  
...  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/6/86ce6e8b82141da4d3e6efff4dd44c413ddcb31f.png)  
...  
So I only want to have the count of 220 from 11:00 be given back.

---

<div class="post-metadata">

**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\
**Post date:** [November 21, 2017, 7:45pm UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/4 "2017-11-21T19:45:16Z")

</div>

Hi @asp,

Try:

1. Create a new Metric visualization
2. Under `Metrics`, select `Sibling Pipeline Aggregations -> Max Bucket`
3. For the bucket, do the same `Date Histogram` aggregation as you're doing
4. For the metric, select `Count`

 ![38 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee50ad7adc9efc3d6a23d2164c9ac75c4bba4f4b.png)

Lemme know if that works!

---

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [November 22, 2017, 8:33am UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/5 "2017-11-22T08:33:04Z")

</div>

Hi,

not working in 5.1.2 which is currently in our production, but working like charm in 5.5.x.  
Since I am currently working on an update to 6.latest I expect it to work there afterwards.

Thanks a lot.

---

<div class="post-metadata">

**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\
**Post date:** [November 22, 2017, 7:51pm UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/6 "2017-11-22T19:51:28Z")

</div>

Great, glad you got something working!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2017, 8:06pm UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-yesterday-with-1-hour-time-bucket/108097/7 "2017-12-20T20:06:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
