Indicators using Data Table VS Visual Builder

[eStrux-MAB]

Hello!

I have a set of devices that I monitor, and for which the data lands into Elastic. For context: each of these devices draw electrical power from two sources, and I want to be aware, using a Kibana visualization, of which source each device is set to be pulling from. This is done via a switch, and the device reports on the position of that switch, in the form of a set of booleans.

One easy option to show that data was via a data table visualization. In plain English, "Give me the max value of each switch setting". The data I get is sane, and reliable:

(Some devices report all zeroes; that's because they are powered off right now.)

Now, I wanted to show that information in a more eye-catching way, and found that in Visual Builder, I could dynamically color these values. Good! I settled on blue for "False" and pink for "True". I set up my metrics once again to be "Max value of each switch setting". However, I get nothing but zeroes:

This is I keep my time period to "Last 15 minutes". If I increase the time period, once I got "Last 2 hours", I finally get data that looks real:

I am not sure I understand what is going on here. Why would Visual Builder misreport on the switch settings when the Data Table works right out of the box? I suppose it has to do something with the metrics or panel options in Visual Builder. Here's how I set things up:

Whether I specify a field/aggregate in the Options tab or not doesn't change the end result.

What am I doing wrong here? How can I make the Visual Builder table report the switch position accurately? It's worth noting that I'll use this visualization only across short time periods (last few minutes) so I'm not too worried about value overlap due to the chosen aggregation.

[wylie (Wylie Conlon)]

Sorry to hear you're seeing issues with TSVB. One area that I'm not clear on from your description is whether your data is continuous- if you use the same settings, but look at the Time Series visualization in TSVB (instead of the table), what do you see? Specifically, does the very last time bucket in that have data?

[eStrux-MAB]

The data is continuous in the sense that the readings we take are consistent. Our readings are not strictly real-time, but rather grabbed every 30 seconds or so.

In the below screenshot, I am examining the Time Series for one of the devices, for which the switch has been set to "S2":

It's worth noting that when I get data from one device, I get each piece of data in a separate command-line execution - so, one execution to figure out if the switch is in S1, another for S2, etc. so the data points for each might not necessarily be lined up to the exact same instant.

[wylie (Wylie Conlon)]

Okay- that explains why you aren't seeing data in the TSVB table. I see in your screenshot that the slice it has decided on is 10 seconds, while you've told me that your sensors are running every 30 seconds. I don't see it in your screenshots, but is there a menu that lets you change from "Auto" interval to another interval? If not you'll need to increase the overall time range for the Auto histogram to change its interval

[eStrux-MAB]

That's a bingo! The interval was the culprit in this affair. I set it to one minute and now the data looks as expected.

Thanks for the help!