# Split and use the term in sub operation in Timelion
**URL:** https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083
**Category:** Kibana
**Tags:** timelion
**Created:** [January 25, 2018, 4:49pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083 "2018-01-25T16:49:57Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@anthony-o](https://discuss.elastic.co/u/anthony-o)
#### Post date: [January 25, 2018, 4:49pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/1 "2018-01-25T16:49:57Z")
Here is my index structure: type, from\_host, to\_host, times
The "type" field can be either "error" or "valid".
I would like to display distinct lines in Timelion corresponding to top 5 "from\_host" keywords, and the y value should equals to the sum of "times" field of "type=valid" lines minus the sum of "times" field of "type=valid" lines for **the selected "from\_host" of this split**.
I have tried this without success: `.es(split=from_host.keyword:5, metric=sum:times, q=type:valid).subtract(.es(metric=sum:times, q=type:error))`
The problem here is that the `from_host` that is selected in the first `.es()` query is not naturally injected in the second one, so the `sum` is done on all `from_host`s in the second `.es()` query.
Is it possible to do this, and if yes, how?
---
### Author:  [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [January 25, 2018, 6:15pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/2 "2018-01-25T18:15:34Z")
So I see that your query has "substract" instead of "subtract" -- maybe that is the issue?
---
### Author:  [@anthony-o](https://discuss.elastic.co/u/anthony-o)
#### Post date: [January 31, 2018, 9:24am UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/3 "2018-01-31T09:24:57Z")
That was a typo in my question, I did use `subtract` in my problematic query.
---
### Author:  [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [January 31, 2018, 1:55pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/4 "2018-01-31T13:55:52Z")
I have created this against the data created by the makelogs script and it seems to work for me
`.es(split=extension.raw:5, metric=sum:bytes, q=response:200).subtract(.es(split=extension.raw:5, metric=sum:bytes, q=response:404))`
So I think this formulation will work for your query:
`.es(split=from_host.keyword:5, metric=sum:times, q=type:valid).subtract(.es(split=from_host.keyword:5, metric=sum:times, q=type:error))`
---
### Author:  [@anthony-o](https://discuss.elastic.co/u/anthony-o)
#### Post date: [January 31, 2018, 2:35pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/5 "2018-01-31T14:35:17Z")
Timelion shows me the following error "`Timelion: Error: in cell #1: argument must be a seriesList with a single series`" (it talks about the fact that `.substract()` should not have a `split` parameter if the first series has already a `split` I think...).
Do you realy have no error with your query that includes 2 `split`s? Don't you have 25 lines at the end?
---
### Author:  [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [January 31, 2018, 2:43pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/6 "2018-01-31T14:43:59Z")
Weird worked for me once, now I see the same error as you are seeing. I will continue to play around with this.
---
### Author:  [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [January 31, 2018, 2:49pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/7 "2018-01-31T14:49:09Z")
This one _does_ seem to work for me:
`.es(split=extension.raw:5, metric=sum:bytes, q=response:200).subtract(.es(metric=sum:bytes, q=response:404))`
---
### Author:  [@anthony-o](https://discuss.elastic.co/u/anthony-o)
#### Post date: [January 31, 2018, 3:04pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/8 "2018-01-31T15:04:20Z")
The problem I think that in your case, for each `extension`, the subtraction is done over `404` `response`s of **every `extension`** and not only of the one coming from the `split` of the first query.
Actually, with your schema, I would like something like the following:
```auto
.es(metric=sum:bytes, q='response:200 AND extension.raw:jpg').subtract(.es(metric=sum:bytes, q='response:404 AND extension.raw:jpg'),
.es(metric=sum:bytes, q='response:200 AND extension.raw:css').subtract(.es(metric=sum:bytes, q='response:404 AND extension.raw:css'),
.es(metric=sum:bytes, q='response:200 AND extension.raw:png').subtract(.es(metric=sum:bytes, q='response:404 AND extension.raw:png'),
...
```
And I think that your queries does the following:
```auto
.es(metric=sum:bytes, q='response:200 AND extension.raw:jpg').subtract(.es(metric=sum:bytes, q=response:404),
.es(metric=sum:bytes, q='response:200 AND extension.raw:css').subtract(.es(metric=sum:bytes, q=response:404),
.es(metric=sum:bytes, q='response:200 AND extension.raw:png').subtract(.es(metric=sum:bytes, q=response:404),
...
```
Am I wrong?
---
### Author:  [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [January 31, 2018, 3:17pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/9 "2018-01-31T15:17:44Z")
You're right, wasn't seeing that. I have found out that what you are trying to do is not currently possible in Kibana. See this issue [https://github.com/elastic/kibana/issues/13781](https://github.com/elastic/kibana/issues/13781). However, a PR was recently merged that addresses this and you should be able to do this in the 6.2 version of Kibana, which should be released very soon.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2018, 3:17pm UTC](https://discuss.elastic.co/t/split-and-use-the-term-in-sub-operation-in-timelion/117083/10 "2018-02-28T15:17:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.