# \[Kibana visualization\] max of sum

**URL:** https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201
**Category:** Kibana
**Created:** [November 1, 2019, 6:01pm UTC](https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201 "2019-11-01T18:01:10Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![yazid](https://avatars.discourse-cdn.com/v4/letter/y/bb73d2/32.png) [@yazid](https://discuss.elastic.co/u/yazid)
#### Post date: [November 1, 2019, 6:01pm UTC](https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201/1 "2019-11-01T18:01:11Z")

</div>

Hi  
need your help to do a max of sum group by document's date field

Assuming I have 2 series , can you please tell me what metric aggregation I have to use to do this:

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66bb73be6b0d36db9bcc885c75832d05440ab2c9.png)

each line is in the separate document  
Thanks in advance for your help

Cheers  
Yazid

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [November 1, 2019, 6:55pm UTC](https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201/2 "2019-11-01T18:55:41Z")

</div>

This sounds like it's a sibling pipeline aggregation: [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-max-bucket-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-max-bucket-aggregation.html)

---

<div class="post-metadata">

### Author: ![yazid](https://avatars.discourse-cdn.com/v4/letter/y/bb73d2/32.png) [@yazid](https://discuss.elastic.co/u/yazid)
#### Post date: [November 1, 2019, 10:20pm UTC](https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201/3 "2019-11-01T22:20:42Z")

</div>

Thanks for your quick reply. But I have already tried this and it is not giving the result I'm expecting.  
Actually, when I'm analyzing a short period and using a short bucket (5 min), so yes it is correct, but when I'm analyzing for a day for example 5 min as a bucket is very short for kibana  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/1/91b5f1f78bc67345314d1daa97f615e0de9e409b.png)

and the result is something like that (assuming bucket is 10 min)

![image](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4c901bcf063a2ea737602242c2feebc9d548776a.png)

actually I need something like  
select MAX (sum (CurrentActiveSessionsTotal) group by date

Yazid

---

<div class="post-metadata">

### Author: ![yazid](https://avatars.discourse-cdn.com/v4/letter/y/bb73d2/32.png) [@yazid](https://discuss.elastic.co/u/yazid)
#### Post date: [November 4, 2019, 7:28am UTC](https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201/4 "2019-11-04T07:28:05Z")

</div>

Hi again

I have a better result using timelion (it was my first try 🙂 ), but still have some incorrect values .  
this is my request

.es(index=telco\_kpi\_idx\*,  
timefield='date',  
metric='max:CurrentActiveSessionsInbound',  
split=name.keyword:5, kibana=1 , q='type : kpi\_realm AND name: Peer\ __edfe\__ AND hostname.keyword :TSBC-11\*',).label(regex='._(PEER)._(LON.\*)',label='($2)'),

.es(index=telco\_kpi\_idx\*,  
timefield='date',  
metric='sum:CurrentActiveSessionsInbound',  
kibana=1 ,q='type : kpi\_realm AND name: Peer\ __edfe\__ AND hostname.keyword :TSBC-11\*',  
).scale\_interval(1m).legend(position=sw).label(label='sum of CurrentActiveSessionsInbound ')

when I request for 1 day the result seems correct

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a03ae7e436398f11cdec44c15ba99127bfcec95e.png)  
max sum of the day = 265

but when I increase the period (3 days for example) I have this

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc71878732dcb4e8140d777e775a61ea752bffb0.png)

as you can see , it shows me 248 as max of the sum values of the same day I showed before.

Do you have any idea how I can solve this please?

Thnks  
Yazid

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2019, 7:28am UTC](https://discuss.elastic.co/t/kibana-visualization-max-of-sum/206201/5 "2019-12-02T07:28:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.