Hi guys,

Am seeking for your help and advice on this one;

This is a timelion query (and the groupby is set to 5min):

`$q='peer_src_ip:x.x.x.x AND ifindex_in:905', .es($q, metric='sum:bytes').multiply(8).divide(300).derivative().color(grey).lines(fill=3)`

that calculates the bitrate of many (netflow) sessions.

Some background info about the dataset:

every 1min,2min,5min, etc. (is random) a measurement is collected that has the specified `peer_src_ip`

and 'if index_in' fields and values specified.

the duration of the measurement is random, so it can last 1min to 1day, but what all measurements have in common is `peer_src_ip`

and `ifindex_in`

In other words, a session is consisted of many measurements that are collected at various different intervals, and each session has a different lifetime; one may exist for 1h, another one for 1day. But at time `t`

let's say both are present, and what is asked is to calculate the the total bits/sec metric.

What I would like to do is:

[1] calculate the derivative of each measurement

[2] then sum up all the derivatives

Instead of that, in the screenshot you can see that first i do a sum of all measurements and then take the derivative (which messes up the rate value)

The closest i could get is:

The first value @11.30 is the correct one (i have double checked it), but when more than 2 points in time are used for plotting this information, the graph is not the expected one.

Could you please advise on how to graph the above info properly ?