# Kibana - Timelion network visualization problems

**URL:** <https://discuss.elastic.co/t/kibana-timelion-network-visualization-problems/114608>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [January 8, 2018, 8:12pm UTC](https://discuss.elastic.co/t/kibana-timelion-network-visualization-problems/114608 "2018-01-08T20:12:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dinon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dinon/32/26342_2.png) [@dinon](https://discuss.elastic.co/u/dinon)\
**Post date:** [January 8, 2018, 8:12pm UTC](https://discuss.elastic.co/t/kibana-timelion-network-visualization-problems/114608/1 "2018-01-08T20:12:04Z")

</div>

HI,  
I am trying to create a netwoek traffic visualization based on timelion.

Network traffic should easily be represented by following expression in timelion: .es(index=metricbeat\*, timefield=@timestamp, metric=max:system.network.in.bytes).derivative()

But here are some findings:

1. for short time periods (less than hour) it is not producing the results  

2. for longer periods it is creating the result and is following the trend, but results are off for big margin (below graph is based on windows perfmon counters and these are real numbers)  

3. here is the timelion definition  

4. for long time periods it looks like counters reach maximum value and upon reset it creates a strange spikes - how to ignore/overcome this  

Thank you!  
DiNo

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [January 10, 2018, 12:15am UTC](https://discuss.elastic.co/t/kibana-timelion-network-visualization-problems/114608/2 "2018-01-10T00:15:32Z")

</div>

hi @dinon,

I'm not sure what that is, it's tough to reproduce on my end. Are you sure that this is not an artefact of the data?

If so, could you try to reproduce these same issues with the sample makelogs data, or with some sample dataset? If so, I can take a look here from my end.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2018, 12:16am UTC](https://discuss.elastic.co/t/kibana-timelion-network-visualization-problems/114608/3 "2018-02-07T00:16:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.