# Timelion chaining cusum() and derivative() on distinct time intervals

**URL:** <https://discuss.elastic.co/t/timelion-chaining-cusum-and-derivative-on-distinct-time-intervals/241600>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [July 17, 2020, 7:53am UTC](https://discuss.elastic.co/t/timelion-chaining-cusum-and-derivative-on-distinct-time-intervals/241600 "2020-07-17T07:53:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Henk21](https://avatars.discourse-cdn.com/v4/letter/h/e9bcb4/32.png) [@Henk21](https://discuss.elastic.co/u/Henk21)\
**Post date:** [July 17, 2020, 7:53am UTC](https://discuss.elastic.co/t/timelion-chaining-cusum-and-derivative-on-distinct-time-intervals/241600/1 "2020-07-17T07:53:52Z")

</div>

I am using timelion to plot the number of connection sessions in our VPN infrastructure. To do so, I have a cumulative sum of the difference between connection and disconnection events. The time interval is set to 1h.

```auto
.es(q='kind.keyword: CISE_Passed_Authentications', index = "logstash-iselog*", timefield = "@timestamp", metric="count").subtract(.es(q='kind.keyword : CISE_RADIUS_Accounting', index = "logstash-iselog*", timefield="@timestamp", metric="count")).cusum().label('Remote Sessions')

```

This shows a sort of waving plot going up and down. So far, so good.  
I would like now to show a weekly trend on those sessions, specifically: doing another cumulative sum, so:

```auto
.es(q='kind.keyword: CISE_Passed_Authentications', index = "logstash-iselog*", timefield = "@timestamp", metric="count").subtract(.es(q='kind.keyword : CISE_RADIUS_Accounting', index = "logstash-iselog*", timefield="@timestamp", metric="count")).cusum().cusum().label('Cumulated Sessions')

```

and then do a derivative on the 'Cumulated Sessions' on a week-based sampling. So, keep from the 'Cumulated Sessions' plot just one data point per week, and do the derivative on those retained points. Or do some sort of chaining cusum() and derivative() but on distinct time intervals. Either way, I don't see how/if this can be done.  
Many thanks in advance

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [August 13, 2020, 11:17am UTC](https://discuss.elastic.co/t/timelion-chaining-cusum-and-derivative-on-distinct-time-intervals/241600/2 "2020-08-13T11:17:23Z")

</div>

Hi @Henk21  
sorry for the late reply, have you already found a solution to your issue?

---

<div class="post-metadata">

**Author:** ![Henk21](https://avatars.discourse-cdn.com/v4/letter/h/e9bcb4/32.png) [@Henk21](https://discuss.elastic.co/u/Henk21)\
**Post date:** [August 31, 2020, 9:01am UTC](https://discuss.elastic.co/t/timelion-chaining-cusum-and-derivative-on-distinct-time-intervals/241600/3 "2020-08-31T09:01:30Z")

</div>

Hi @markov00 . Sorry for my late reaction too. No, I haven't found a solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2020, 9:01am UTC](https://discuss.elastic.co/t/timelion-chaining-cusum-and-derivative-on-distinct-time-intervals/241600/4 "2020-09-28T09:01:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.