# Inflated record count in when viewed in Kibana line chart

**URL:** https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075
**Category:** Elasticsearch
**Created:** [February 5, 2016, 3:11pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075 "2016-02-05T15:11:59Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [February 5, 2016, 3:11pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/1 "2016-02-05T15:11:59Z")

</div>

I load 1 day of data, looks good. If I load the data for the next date, new timestamp, I am getting an sum of my values.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/b/b991836d951d2ddbeff424d93477477fc7aa688a.jpg)  
Example:

membership type A  
2016-02-04 : count = 13,694  
2016-02-04 : count = 6857

Why am I getting accumulated values? Shouldn't the count be specific to the day/date?  
Here is a screen shot from KIbana.

Also, Why do I have more data the day before? Twice the records the day before?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 5, 2016, 3:16pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/2 "2016-02-05T15:16:03Z")

</div>

If you set the interval to "Auto" you will get a more detailed view. Could it be that it is related to a time zone issue and all entries to Kibana appear to belong to the same day?

---

<div class="post-metadata">

### Author: ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [February 5, 2016, 3:18pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/3 "2016-02-05T15:18:09Z")

</div>

I can look into that. But I see something strange.

I deleted all the data on Feb 4th, today on the 5th, 1 of my data points is for Feb 1st?  
How did that happen? Do I need to flush or something?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 5, 2016, 4:41pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/4 "2016-02-05T16:41:11Z")

</div>

Why not explore and inspect the data in the Discover view instead to get a better understanding for the distribution of timestamps etc?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 6, 2016, 1:36am UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/5 "2016-02-06T01:36:33Z")

</div>

It could be TZ differences.

---

<div class="post-metadata">

### Author: ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [February 8, 2016, 3:10pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/6 "2016-02-08T15:10:36Z")

</div>

Changing the interval does not help.  
I decided to delete everything and start fresh.

My day 1 is now inflated. but my next two days look good.

The ubuntu server elastic is running on had a bad date, it was 5 hours ahead.  
Still not sure about this yet.

---

<div class="post-metadata">

### Author: ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [February 8, 2016, 4:48pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/7 "2016-02-08T16:48:53Z")

</div>

I reset my timezone, I guess we will see what happens tomorrow.

Today I have 3 data points.  
The 1st is inflated the but the next 2 look normal.

---

<div class="post-metadata">

### Author: ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [February 8, 2016, 4:51pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/8 "2016-02-08T16:51:32Z")

</div>

How can a differerence in time zones affect this?  
Would'nt each entry be in the same time zone? I only have 1 server loading data into elasticsearch.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 9, 2016, 1:13am UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/9 "2016-02-09T01:13:53Z")

</div>

If you're using a time range that doesn't contain all the data you think it should.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:18pm UTC](https://discuss.elastic.co/t/inflated-record-count-in-when-viewed-in-kibana-line-chart/41075/10 "2017-07-05T23:18:07Z")

</div>


