Newbie help > report of values diff'ed over time

[robyb (Roby)]

Can I start my first post with an intro. I'm a Product Manager, so speak to me like I'm not an engineer...

I have the following dataset. A list of Microsoft license types and a count of number of users with that license assigned, per license type.

We have this as time series data, which is why I use unique counts and I'm limiting my range filter to previous month.

My goal is to do a same version of this, where the count column would display the difference in counts of licenses from 2 months ago vs 1 month ago, to show either an increase, decrease or no change in number of license consumption, per license type.

Can Kibana support this? I've attempted to use a formula for my metric doing something like unique_count(primaryEmail.keyword, shift="2M") - unique_count(primaryEmail.keyword, shift="1M"), but then it complains about my Microsoft License row and tells me to use a filter, at which point adding licenses.keyword : * simply displays something like this rather than continuing to enumerate the license types.

Thank you in advance for any guidance!!

[bhavyarm]

Hi,

AFAIK, you can use formulas and timeshift in lens to do this - Analyze time series data | Kibana Guide [8.6] | Elastic

I am also copying @Stratoula_Kalafateli here to give more inputs.

Thanks,
Bhavya

[Stratoula_Kalafateli]

@robyb welcome to our community! Your formula seems correct to me. Can you share the warning you get from Lens?

[robyb (Roby)]

@robyb

unique_count(primaryEmail.keyword, shift="2M") - unique_count(primaryEmail.keyword, shift="1M")

Thank you for the reply. Here's what I get when I try to enter the formula in my Metric.

[Stratoula_Kalafateli]

Do you have a breakdown? Because in that case we don't allow cacuations on metrics with different shifts. The reason is that at that case you have different top values per shift so it doesnt make sense.

[robyb (Roby)]

Thank you. I'm not sure what you mean by a breakdown? What I'm trying to accomplish is to show each license types and the difference in number of counts over the months, but adding a filter doesn't seem to work. If this isn't possible then that's fine, I just don't know what I don't know

[Stratoula_Kalafateli]

Yes sorry I should be more specific, so you can do something like this

but if you can't split with top values

[robyb (Roby)]

Thank you. I think this is solved, I couldn't use "*" to iterate all the licenses, but if I reference each one it worked

Much appreciated!