# Kibana 6 - Visualization Buckets at different timescales \[RESOLVED\] **URL:** \ **Category:** Kibana\ **Created:** [October 26, 2017, 9:59am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394 "2017-10-26T09:59:43Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [October 26, 2017, 9:59am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/1 "2017-10-26T09:59:43Z")
I have regular data coming in from heartbeat for 4 https server checks, every 20 seconds. The data is fine. Visualizing the last hour looks great: ![ResponseTimes-1Hour](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b49a66462ba617c762a00b988228193914a3ff79.png) Visualizing the last 12 hours is half empty (including the last hour which clearly has data): ![ResponseTimes-12Hours](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0a3f6c057a9e236df3fc85618e46d9bcf99206c.png) ---
**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\ **Post date:** [October 27, 2017, 2:54am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/2 "2017-10-27T02:54:17Z")
@thomasneirynck this is odd, any ideas here? ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [October 27, 2017, 5:57am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/3 "2017-10-27T05:57:17Z")
It seems to have something to do with the bucket size and time interval for the histogram. If I try to set the interval to one minute it will fix the graph for 4 hours but the 12 hour graph will give this (!) for interval: ![ResponseTimes-12Hours-bucketsize](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56ed51115c07836f97ab24921fb4ff16ac869113.png) > This interval creates too many buckets to show in the selected time range If I select 24 hours OR 15 minutes it actually says no results found on the chart! Ah! I got it. I had the split after/below the @timestamp histogram. When I switch them it fixes itself. Any explanation why that would be? ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [October 27, 2017, 6:00am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/4 "2017-10-27T06:00:08Z")
Before (broken): ![Before-Broken-SplitSecond](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e0ad403b9c6b0d43c382324fed9c3432a974f30.png) After (working): ![After-Working-SplitFirst](https://us1.discourse-cdn.com/elastic/original/3X/2/7/272cfa9a5c8bc880c180589d3132f0f282710e91.png) ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [November 3, 2017, 8:02am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/5 "2017-11-03T08:02:27Z")
Another strange visualization phenomenon: When set to 24 hours, all the heartbeat monitors except for one (dev) show up: ![24hours-everythingExceptDev](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e76015f83c41d1c4a2c9966223e62bcea3f56ee.png) When set to 12 hours, only dev shows up: ![12Hours-DevOnly](https://us1.discourse-cdn.com/elastic/original/3X/2/5/250b1a53a7911c2428d14efa3079f5cb09eac42c.png) Any ideas? ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [November 4, 2017, 4:28pm UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/6 "2017-11-04T16:28:13Z")
@thomasneirynck and @tylersmalley, Could this be a bug in Kibana 6rc1 ? My data is coming in from heartbeat one http monitor every minute (for each site - so 4 logs per minute)... but the chart is behaving strangely (see above - different buckets at different timescales) ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [November 4, 2017, 4:33pm UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/7 "2017-11-04T16:33:08Z")
It is quite clear that the data is there, 10 logs for dev every 10 mintues: ![10reportsFromDevEvery10minutes](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02d81f06e4074176e42867b0cbe3556894b7d02c.png) 25% for each site: ![KibanaAll4Sites](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5c9390e2dd800743c459e54bb99b772c056b89a.png) ---
**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\ **Post date:** [November 7, 2017, 10:24pm UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/8 "2017-11-07T22:24:57Z")
hi @gotjoshua, I don't know what this could be. When you open the spy-panel in the visualization (little grey-arrow in the bottom left), is the correct data there in your raw Elasticsearch-response? ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [November 8, 2017, 7:03am UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/9 "2017-11-08T07:03:40Z")
Thanks for the reply, and for the pointer to the spy-panel. The spy panel shows the same as the chart. I even discovered that if I choose 1 hour timescale then it shows "No Results" ---
**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Post date:** [November 8, 2017, 2:39pm UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/10 "2017-11-08T14:39:53Z")
I think I solved this, but now I'd love an explanation: I got the feeling that it _must_ be something with the bucket sorting, so... I switched my split series setting to use terms, instead of significant terms, and then all timescales show all data series. It seems that Significant Terms is quite a fancy query: > [The numbers returned for scores are primarily intended for ranking different suggestions sensibly rather than something easily understood by end users. The scores are derived from the doc frequencies in foreground and background sets. In brief, a term is considered significant if there is a noticeable difference in the frequency in which a term appears in the subset and in the background.](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-significantterms-aggregation.html#_multi_set_analysis) In my case, as all four terms are coming in at the same frequency, I guess the only significant differences are based on how many data points were stashed in a selected time range... Creates a quite odd effect, but the system is behaving statistically accurately i guess... Should we call this User "error", or could the Significant Terms algorithm be adjusted to include all terms if they are all coming in at the same frequency? ---
**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\ **Post date:** [November 15, 2017, 9:03pm UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/11 "2017-11-15T21:03:09Z")
hi @gotjoshua, significant terms is an odd one. It's basically only useful if you use it as a sub-aggegation, because then you get to compare each "sub-bucket" to the background-set. It's tough to find good examples on how to use it in Visualize. Usually, most use-cases are not time-series related. Not sure if this answered your question.. 🙏 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 13, 2017, 9:03pm UTC](https://discuss.elastic.co/t/kibana-6-visualization-buckets-at-different-timescales-resolved/105394/12 "2017-12-13T21:03:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.