Am seeking for your help and advice on this one;
This is a timelion query (and the groupby is set to 5min):
$q='peer_src_ip:x.x.x.x AND ifindex_in:905', .es($q, metric='sum:bytes').multiply(8).divide(300).derivative().color(grey).lines(fill=3)
that calculates the bitrate of many (netflow) sessions.
Some background info about the dataset:
every 1min,2min,5min, etc. (is random) a measurement is collected that has the specified
peer_src_ip and 'if index_in' fields and values specified.
the duration of the measurement is random, so it can last 1min to 1day, but what all measurements have in common is
In other words, a session is consisted of many measurements that are collected at various different intervals, and each session has a different lifetime; one may exist for 1h, another one for 1day. But at time
t let's say both are present, and what is asked is to calculate the the total bits/sec metric.
What I would like to do is:
 calculate the derivative of each measurement
 then sum up all the derivatives
Instead of that, in the screenshot you can see that first i do a sum of all measurements and then take the derivative (which messes up the rate value)
The closest i could get is:
The first value @11.30 is the correct one (i have double checked it), but when more than 2 points in time are used for plotting this information, the graph is not the expected one.
Could you please advise on how to graph the above info properly ?