Kibana - Timelion network visualization problems

[dinon]

HI,
I am trying to create a netwoek traffic visualization based on timelion.

Network traffic should easily be represented by following expression in timelion: .es(index=metricbeat*, timefield=@timestamp, metric=max:system.network.in.bytes).derivative()

But here are some findings:

1. for short time periods (less than hour) it is not producing the results
   

   

2. for longer periods it is creating the result and is following the trend, but results are off for big margin (below graph is based on windows perfmon counters and these are real numbers)
   

   

3. here is the timelion definition
   

   

4. for long time periods it looks like counters reach maximum value and upon reset it creates a strange spikes - how to ignore/overcome this
   

   

Thank you!
DiNo

[thomasneirynck]

hi @dinon,

I'm not sure what that is, it's tough to reproduce on my end. Are you sure that this is not an artefact of the data?

If so, could you try to reproduce these same issues with the sample makelogs data, or with some sample dataset? If so, I can take a look here from my end.