Mismatch between timelion and discover doc count

[dejard]

Hi,

I have indexed a bunch of documents which I want to filter by a field named cell with a value of 5. Searching for this field on the Discover page results in 20 hits.

The documents contain the following timestamps:

2018-09-28T10:44:57.305
2018-09-28T10:44:57.323
2018-09-28T10:44:57.373
2018-09-28T10:44:57.416
2018-09-28T10:44:58.817
2018-09-28T10:44:59.039
2018-09-28T10:44:59.080
2018-09-28T10:44:59.181
2018-09-28T10:45:00.258
2018-09-28T10:45:00.580
2018-09-28T10:45:01.977
2018-09-28T10:45:02.271
2018-09-28T10:45:04.283
2018-09-28T10:45:04.747
2018-09-28T10:45:05.985
2018-09-28T10:45:06.247
2018-09-28T10:45:07.324
2018-09-28T10:45:07.896
2018-09-28T10:45:09.800
2018-09-28T10:45:10.214

However, splitting the documents with Timelion displays just 13 hits.

Also the positions of peaks on the time-axis are wrong. The first peak should be at 12:44:57 (UTC+2) but Timelion displays it at 12:44:55. Maybe I'm misunderstanding the concept of the split function.

Dejard

[christophilus (Chris Davies)]

I think you need to pay around with your limit. I took your data and addeda. "foo" column with 5 "baz" values, 5 "zed" values, and 10 "bar" values.

[dejard]

Hi Chris,

thanks for your reply. I already tried different time ranges with different intervals. It never exceeds 13. And as already mentioned, the timestamps do not match either. Here is another view of the filtered data:

Is it possible to configure kibana to log the corresponding data matched by timelion?

EDIT: Chris, you were absolutely right. I had to adjust time range and interval carefully to get the correct number of peaks displayed in one timelion graph. But nevertheless, the peak-positions are incorrect. It shows me peaks for timestamps that don't exist. Anyway, thanks for your help.

[christophilus (Chris Davies)]

I don't think the time range is your problem, so much as split=cell:1 Try split=cell:10 or split=cell:100. That number is what is causing the inaccuracy, as it's a limit function.