# How to visualize tally counters (Serial Diff maybe?) **URL:** \ **Category:** Kibana\ **Created:** [June 17, 2018, 5:22am UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194 "2018-06-17T05:22:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 17, 2018, 5:22am UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/1 "2018-06-17T05:22:58Z")
Using Kibana 5.4.1 I have a fairly common use case whereby servers send counter metrics at regular interval. Those counters are just a tally of some event, for example the number of connections opened, or some errors since the process started. Those stats are meant to be compact, and while one could use 1 doc per "event", it's not the case here. So how would I go about visualizing the evolution of that counter over time? It seems a potential candidate would be "Serial Diff" which subtracts a value at previous time from the current value. And it seems to be working as expected, but there is a problem that makes it unusable: graph always starts with a huge spike and ends with a massive drop, no matter the time window selected. It's like it's not happy with the 1st and last bucket. Any way to fix / ignore those buckets? Example: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/0/20c2ead288086baa3e8c8b1cb253a353911427e8.png) thanks much! ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [June 18, 2018, 5:13pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/2 "2018-06-18T17:13:18Z")
Have you looked into the visual builder visualization type at all? There is a serial difference option, and also an option to drop the last bucket which might help you with the drop at the end. ![26%20PM](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66df9e6c24a90e73c3fb6bb705ff400c69885469.png) ---
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 18, 2018, 5:40pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/3 "2018-06-18T17:40:54Z")
Ok perfect, looks exactly like what I need, I was just delayed a few versions 🙂 Thanks much! ---
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 18, 2018, 7:54pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/4 "2018-06-18T19:54:36Z")
It looks like I will still have to wait for > I need to upgrade to have access to "drop last bucket" but even then it sounds like it may not yet drop the 1st partial bucket? > ---
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 19, 2018, 5:09am UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/5 "2018-06-19T05:09:25Z")
It looks like I am able to visualize diffs properly with following setting: - Metric 1: Max of the given counter - Metric 2: Serial diff of that max - Group by: server name It seem to be doing the job properly of grouping by time bucket / server name, then doing the diff of 1 bucket to the next. The 1st and last buckets do not seem to be an issue. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/408e94f72906c300c172aff84a490c6176ba8f08.jpg) ---
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 27, 2018, 6:36pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/6 "2018-06-27T18:36:37Z")
This is still not ideal, for example when a counter rolls or a server is restarted it may show huge negative values that make it harder to visualize. I was wondering, does Timelion support doing diffs between buckets following a split? Something like: .es(index='myindex\_\*', timefield='time', split='servername:1', metric='requestcounter').serialDiff() I guess a more generic question is: what's the best way to visualize counter type metrics with Timelion (where a counter at time T should get subtracted from T-1 to infer the change in value)? ---
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 27, 2018, 6:58pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/7 "2018-06-27T18:58:35Z")
Looks like this is potentially one way: > ---
**Author:** ![agirbal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agirbal/32/59659_2.png) [@agirbal](https://discuss.elastic.co/u/agirbal)\ **Post date:** [June 28, 2018, 11:03pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/8 "2018-06-28T23:03:13Z")
Got to a pretty good state using the Visual Builder (though I cannot do the ratios / diff between series like with timelion). The trick is to add an extra FilterPositive agg as child of the SerialDiff to remove rollovers. Last little gripe about Visual Builder: why are the same values using different colors in each graph? Anyway to fix in Kibana v5 latest? Thanks! ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/089c289c7b2e119cabf229e6b84c23ae484b5e96.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2018, 11:03pm UTC](https://discuss.elastic.co/t/how-to-visualize-tally-counters-serial-diff-maybe/136194/9 "2018-07-26T23:03:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.