# Parameters in Using Calculation aggregation **URL:** \ **Category:** Kibana\ **Created:** [December 19, 2017, 7:23am UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369 "2017-12-19T07:23:49Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 19, 2017, 7:23am UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/1 "2017-12-19T07:23:50Z")
Hi guys, i am trying to use calculation aggregation in TSVB as below: ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6c33d7d20f226e19f4d2c7f4e13ee78e2e1b6db.png) but is there way where i can find the number of events matching the criteria in the given timeframe using the painless script??? what other functions i can use in calculation agg.??? Please help.... i want to count the events matching `(params.avg - params.std)> 0)` condition?? ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [December 19, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/2 "2017-12-19T13:01:02Z")
Can you please describe what exactly would you like to achieve there ? The current painless script will produce only 1 and 0 values for each of the buckets and it wont actually count all the documents where that expression would be true. However I don't fully understand what would you expect the average be for each document, or the standard deviation ? I think those only make sense when you are looking at buckets (multiple documents grouped together). So at this point it looks to me this is something that you won't be able to achieve, but @simianhacker might know more ? ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 19, 2017, 1:20pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/3 "2017-12-19T13:20:25Z")
here i am comparing the data for anomalies and if the current average value passes the standard deviation value, there i want to use metric tab in TSVB for displaying status based on the passed value (1 or 0). I want to know if it's possible to calculate the no. of instances for which the anomalies occurred, basically how many times does the average value passed the std deviation value...?? **Is it possible in Painless script to get the count of anomalies occurred??** @ppisljar @simianhacker please help!! ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [December 19, 2017, 2:17pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/4 "2017-12-19T14:17:58Z")
that script will run once per bucket and produce either 0 or 1 .... if you would wish to sum all this 1s you could add another cumulative sum aggregation to sum all the 1s together which will then give you a single value. ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [December 19, 2017, 2:18pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/5 "2017-12-19T14:18:40Z")
by the way, @simianhacker will be online in few hours ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 19, 2017, 2:21pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/6 "2017-12-19T14:21:30Z")
Thanks for the reply @ppisljar. And i tried the cumSum of calculation aggs and it gave an error. ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6ce88231799fba0953cc920a3e4b83a5145691c0.png) ---
**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\ **Post date:** [December 19, 2017, 2:42pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/7 "2017-12-19T14:42:02Z")
You will want to use "Overall Sum" and then choose the calculation as the metric. That will sum up all the 1's and give you the total number of times it crossed the threshold. ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 19, 2017, 2:44pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/8 "2017-12-19T14:44:49Z")
@simianhacker Hi Chris, I tried your solution but it seems to give an error as well. ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/9927e7bb372988272c9d40b050533e5d7ca226b7.png) ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 20, 2017, 1:10pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/9 "2017-12-20T13:10:39Z")
@simianhacker Hey Chris, can you please suggest what to do for this error in TSVB?? ---
**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\ **Post date:** [December 20, 2017, 2:44pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/10 "2017-12-20T14:44:22Z")
Which version of Kibana are you using? Does that error occur without the "Overall Sum"? Usually that error indicates a permissions problem with the index pattern you're using. ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 21, 2017, 6:30am UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/11 "2017-12-21T06:30:08Z")
hey @simianhacker, I am using 6.0.1 version. No, the error does not appear without "Overall Sum" aggs. And now the error being displayed is a little **different** : ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/1/61538ce955a80e32e80e19e62ace48e32f1c46f1.png) **And also I tried with cumulative sum aggs** ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/8/285309c54c751e4787faccc1ace8053d75e8488a.png) ---
**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\ **Post date:** [December 21, 2017, 5:56pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/12 "2017-12-21T17:56:51Z")
There is a bug with overall sum in 6.0.1 where it throws an error because the format of the buckets path for sibling aggs changed. It has been fixed in 6.1.1 ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 21, 2017, 6:10pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/13 "2017-12-21T18:10:05Z")
@simianhacker oh okay!! but what aggregation is right for this case, cumsum or Overall sum??? ---
**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\ **Post date:** [December 21, 2017, 6:36pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/14 "2017-12-21T18:36:28Z")
Overall Sum is technically correct but cumulative sum should work, except there is a bug with cumulative sum in Elasticsearch: [https://github.com/elastic/elasticsearch/issues/27544](https://github.com/elastic/elasticsearch/issues/27544) ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 21, 2017, 6:42pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/15 "2017-12-21T18:42:52Z")
@simianhacker Yeah I tried with cumsum few hours back it was working fine but after some time it keeps giving the error `"The request has failed for this panel` . Also sometimes while grouping this agg on terms it gives that panel error. ---
**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\ **Post date:** [December 21, 2017, 7:57pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/16 "2017-12-21T19:57:27Z")
Yeah.... cumulative sum is hit or miss because of that bug. 6.1.1 is pretty solid ---
**Author:** ![Shubham\_Mahajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_mahajan/32/22140_2.png) [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Post date:** [December 21, 2017, 7:58pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/17 "2017-12-21T19:58:29Z")
oh man, we just upgraded to 6.0.1 last week. 😅 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 18, 2018, 7:58pm UTC](https://discuss.elastic.co/t/parameters-in-using-calculation-aggregation/112369/18 "2018-01-18T19:58:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.