# Timelion gaps in dashboard display data (SNMP interface utilization) **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [November 5, 2020, 9:37pm UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460 "2020-11-05T21:37:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [November 5, 2020, 9:37pm UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/1 "2020-11-05T21:37:38Z")
Hello, Recently I have made my first logstash pipeline that ingests data gathered via SNMP form network devices regarding interfaces statistic. I have made timelion graph to displayed network interface utilization but I notice that from time to time I am shown a dashboard with "missing" data. I don't really know how to debug this to please advise how I can show all data with no gaps.. ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fcf0dc86da5039fdbf40e55decbaf64f436f7edf.png) My script looks like this ``` .es(index=network-devices*, timefield=@timestamp, metric=max:cisco.device.system.interface.ifInOctets,split=cisco.device.system.interface.ifName.keyword:150) .derivative().divide(.es(index=network-devices*, timefield=@timestamp, metric=max:cisco.device.system.interface.ifSpeed)).multiply(100) .label("[$1] IN", "^.* > cisco.device.system.interface.ifName.keyword:(\S+) > .*") .if(lt,0.001,null) , .es(index=network-devices*, timefield=@timestamp, metric=max:cisco.device.system.interface.ifOutOctets,split=cisco.device.system.interface.ifName.keyword:150) .derivative().divide(.es(index=network-devices*, timefield=@timestamp, metric=max:cisco.device.system.interface.ifSpeed)) .multiply(100).label("[$1] OUT", "^.* > cisco.device.system.interface.ifName.keyword:(\S+) > .*") .if(lt,0.001,null) ``` If I get rid of " .if(lt,0.001, null)" this is how the dashboard looks like. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c775d0eb415fc1fe6c1902d46e6ac8798467cae9.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71e082c331dd75bc177177f1feba2a07ff9a059d.png) While writing this post I realize that this happens because counters continuously restart after some period of time. This is because I used 32 bit counter and should 64bit, anyway this problem with occur but less often. I imagine that some resolution would be an if statement that says if the value is negative I should add the current value to the next value and then take the derivative and other calculation and offset everything +1 forward. Or something like this. Does anyone have any idea how to deal with this? ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [November 6, 2020, 12:15am UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/2 "2020-11-06T00:15:21Z")
I was thinking about that and I figured that since this filed max value is 2 exp 64 = 18,446,744,073,709,551,616 (about 18.4 quintillion) whenever I got negative value from my derivative that means I need to add 2 exp 64 to first value and then apply derivative. How can I implement this? ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [November 9, 2020, 12:38am UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/3 "2020-11-09T00:38:39Z")
I figured out that I can use logstash output plugin to save the last event to file and input plugin to read them with every new event and get my data in this way. ---
**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\ **Post date:** [November 11, 2020, 6:51pm UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/4 "2020-11-11T18:51:48Z")
It sounds like you've solved your own problem, but there is also a fitting function option in timelion that lets you fill gaps in the data. ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [November 11, 2020, 9:44pm UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/5 "2020-11-11T21:44:07Z")
How is It called? I will check that. ---
**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\ **Post date:** [November 11, 2020, 9:48pm UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/6 "2020-11-11T21:48:44Z")
It is `.fit(mode=average)` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 9, 2020, 9:48pm UTC](https://discuss.elastic.co/t/timelion-gaps-in-dashboard-display-data-snmp-interface-utilization/254460/7 "2020-12-09T21:48:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.