# In Kibana Agg Based Metric, how to show in the results only the highest (doc\_count wise) '1 min' bucket?

**URL:** <https://discuss.elastic.co/t/in-kibana-agg-based-metric-how-to-show-in-the-results-only-the-highest-doc-count-wise-1-min-bucket/322257>\
**Category:** Kibana\
**Tags:** lens\
**Created:** [January 1, 2023, 9:34am UTC](https://discuss.elastic.co/t/in-kibana-agg-based-metric-how-to-show-in-the-results-only-the-highest-doc-count-wise-1-min-bucket/322257 "2023-01-01T09:34:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tds21](https://avatars.discourse-cdn.com/v4/letter/t/e36b37/32.png) [@tds21](https://discuss.elastic.co/u/tds21)\
**Post date:** [January 1, 2023, 9:34am UTC](https://discuss.elastic.co/t/in-kibana-agg-based-metric-how-to-show-in-the-results-only-the-highest-doc-count-wise-1-min-bucket/322257/1 "2023-01-01T09:34:06Z")

</div>

I created an Agg Based Metric with:

METRICS -  
_Max Bucket_ aggregation, that has bucket terms agg for source IP, which basically counts the top source IP and returns it

BUCKETS -  
Date Histogram with timestamp field, with minimal interval of 1 min.

That combination returns multiple results (based on selected time frame) in 1 min bucket, each with a value (doc count) that represents the top source acted at this minute, see below:

 ![2023-01-01 11_23_12-10.65.50.100 - Remote Desktop](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d62ed2277e904ee8933f5f2d561c3ae04bffcf07.png)

I'd like to return **only the highest result** (highlighted in YELLOW), so that the metric will show a single value which represent the highest actor in the selected timeframe.

How can I achive it in agg based metric/other metric type?

• could json input field on the BUCKETS section assist with selecting the top result (can't seem to get it to work, I lack of the right syntax I guess)

Appreciate your help.

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [January 16, 2023, 5:04pm UTC](https://discuss.elastic.co/t/in-kibana-agg-based-metric-how-to-show-in-the-results-only-the-highest-doc-count-wise-1-min-bucket/322257/2 "2023-01-16T17:04:49Z")

</div>

I don't think you can do that with Kibana visualizations without getting into coding something with [Vega](https://www.elastic.co/guide/en/kibana/current/vega.html).

The closest visualization I can think is to use the new Metric visualization and color-encode your metrics to highilght the biggest value with something like this:

On the new metric, go to Appearance and select to run a `dynamic color encoding`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee755a78d51943e81618c416784d249257d8159c.png)

Then tune the distribution of values to add a `99` percent class that will give color to the highest value in your data distribution.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b26ca83622648a7fd022e67b59c1747c7c133d1.png)

Hope it helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2023, 5:05pm UTC](https://discuss.elastic.co/t/in-kibana-agg-based-metric-how-to-show-in-the-results-only-the-highest-doc-count-wise-1-min-bucket/322257/3 "2023-02-13T17:05:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.