# Timelion and split with an if statement help

**URL:** <https://discuss.elastic.co/t/timelion-and-split-with-an-if-statement-help/234451>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [May 27, 2020, 3:54am UTC](https://discuss.elastic.co/t/timelion-and-split-with-an-if-statement-help/234451 "2020-05-27T03:54:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bjeeves](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bjeeves](https://discuss.elastic.co/u/bjeeves)\
**Post date:** [May 27, 2020, 3:54am UTC](https://discuss.elastic.co/t/timelion-and-split-with-an-if-statement-help/234451/1 "2020-05-27T03:54:25Z")

</div>

Hi

I am looking for some help and not sure if I am doing it right or if it's possible so here I go on my problem.

I am monitoring a switch interfaces with netconf/python and storing the values into ES. Then using timelion to show the bandwidth for the interfaces. See below the query has been shorted to make this easier.  
fields:

```auto
nc_name = GigabitEthernet1/0/11
nc_in-octets = integer type long
nc_admin-status: UP or DOWN 
more fields in the doc than this.

```

Query

```auto
.es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_admin-status:UP AND nc_port-speed : "SPEED_1GB"',timefield=@timestamp,split=nc_name.keyword:3).derivative()

```

This works well until I try and put in threshold when the value is great then some value in the graph for that interface that crossed the threshold.

```auto
.es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_admin-status:UP AND nc_port-speed : "SPEED_1GB"',timefield=@timestamp,split=nc_name.keyword:3).derivative(), .es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_admin-status:UP AND nc_port-speed : "SPEED_1GB"',timefield=@timestamp,split=nc_name.keyword:3).derivative().if(gt,40000000,.es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_admin-status:UP AND nc_port-speed : "SPEED_1GB"',timefield=@timestamp,split=nc_name.keyword:3).derivative(),null).color(color=yellow)

```

What I get is threshold value showed on the split first interface for all the interfaces in the split. I hope the screenshots are better at showing what I mean than me.

 ![Screen Shot 2020-05-27 at 1.39.19 pm](https://us1.discourse-cdn.com/elastic/original/3X/8/5/852c275a6aa1f0f5288dd4c728bfbed3873514aa.png)  
 ![Screen Shot 2020-05-27 at 1.39.35 pm](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1d4afb6db326e92e50cacca43e0936db636c82e.png)

I got this one working but now not sure it is or I am lucky that the first interfaces in the split is then one crossing the threshold.

 ![Screen Shot 2020-05-27 at 1.50.21 pm](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f977e03d9fadc59e2b292946967bd8cbb00bb527.png)

---

<div class="post-metadata">

**Author:** ![bjeeves](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bjeeves](https://discuss.elastic.co/u/bjeeves)\
**Post date:** [May 31, 2020, 11:09pm UTC](https://discuss.elastic.co/t/timelion-and-split-with-an-if-statement-help/234451/2 "2020-05-31T23:09:09Z")

</div>

Hi

Is this not clear on what I am trying to do. Or is it that easy I have miss it completely.

Ben

---

<div class="post-metadata">

**Author:** ![bjeeves](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bjeeves](https://discuss.elastic.co/u/bjeeves)\
**Post date:** [June 3, 2020, 2:04am UTC](https://discuss.elastic.co/t/timelion-and-split-with-an-if-statement-help/234451/3 "2020-06-03T02:04:46Z")

</div>

So I have done a little more digging into this and it looks like split in the if statement is only doing it on the first value. See screenshot below.

 ![Screen Shot 2020-06-03 at 11.20.59 am](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f89317712adf15abfa0bda3eacc6965a9d85cad8.png)

Is this the behaviour I should be seeing in the if statement below. Or is my if statement wrong.

```auto
.es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_port-speed:SPEED_1GB AND nc_admin-status:UP NOT nc_name:"GigabitEthernet1/0/15" AND NOT nc_name:"GigabitEthernet1/0/11"',split=nc_hardware-port.keyword:5).derivative().fit(mode=carry).divide(divisor=60), .es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_port-speed:SPEED_1GB AND nc_admin-status:UP NOT nc_name:"GigabitEthernet1/0/15" AND NOT nc_name:"GigabitEthernet1/0/11"',split=nc_name.keyword:5).derivative().fit(mode=carry).divide(divisor=60).fit(mode=carry).if(gt,5400,.es(index=nc_interface_stats-*,metric=avg:nc_in-octets,q='_exists_:nc_in-octets AND nc_port-speed:SPEED_1GB AND nc_admin-status:UP NOT nc_name:"GigabitEthernet1/0/15" AND NOT nc_name:"GigabitEthernet1/0/11"',split=nc_hardware-port.keyword:5).derivative().fit(mode=carry).divide(divisor=60),null).color(color=red).label(Warning)

```

Any pointers to the right path would be good.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2020, 2:04am UTC](https://discuss.elastic.co/t/timelion-and-split-with-an-if-statement-help/234451/4 "2020-07-01T02:04:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.