We're on Kibana 6.6. My Firewall Guy has asked me to build him some Top Talkers and Listeners visualizations for our proof of concept display of the Elastic Stack. I've thought I'd be nice and build him a table of what the Top Talkers are most frequently talking to but every time I make the split table size more than 1 I get a lot more than the number listed.
Table Visualization Settings: Metrics Metric: Count Buckets Split Rows Aggregation: Terms Field: receiving_host.keyword Order By: metric: Count Order: Descend Size: 20 Split Table Columns Sub Aggregation: Terms Field: sending_host.keyword Order By: Metric: Count Order: Descend Size: *
When I set the spot marked with * to 1 I get 1 table
When I set the spot marked with * to 2 I get 8 tables
When I set the spot marked with * to 3 I get 11 tables
When I set the spot marked with * to 4 I get 18 tables
And so on and so forth.
Is it supposed to do that? If so, what's the formula for how many tables it's generating? I'd kind of like to generate 4 or 5 instead of 8