# Timelion interface traffic query

**URL:** <https://discuss.elastic.co/t/timelion-interface-traffic-query/240031>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [July 6, 2020, 3:44pm UTC](https://discuss.elastic.co/t/timelion-interface-traffic-query/240031 "2020-07-06T15:44:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kbrown](https://avatars.discourse-cdn.com/v4/letter/k/f475e1/32.png) [@kbrown](https://discuss.elastic.co/u/kbrown)\
**Post date:** [July 6, 2020, 3:44pm UTC](https://discuss.elastic.co/t/timelion-interface-traffic-query/240031/1 "2020-07-06T15:44:57Z")

</div>

Hi,

I'm trying to fix a timelion query for interface traffic via snmp with ifHCInOctets and ifHCOutOctets.

I've tried it in a few ways, trying to follow examples from this forum and also from [https://berrynetworks.wordpress.com/2019/08/30/juniper-srx-performance-monitoring-with-the-elastic-stack/](https://berrynetworks.wordpress.com/2019/08/30/juniper-srx-performance-monitoring-with-the-elastic-stack/)

#1 -  
.es(index=dc1snmp\*,metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2).divide(8).mvavg(30s).yaxis(units=bits/s,max=100000000).label("Ingress x2 WAN").lines(fill=1,width=2).scale\_interval(1s)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/78f713cff48443e7875519d23635153300ff01f1.png)

#2 -  
.es(index=dc1snmp\*,metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2).subtract(.es(index=dc1snmp\*, metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2, offset=-30s).multiply(8).mvavg(30s).yaxis(units=bits/s,max=10000000000).label("Ingress x2 WAN").lines(fill=1,width=2).scale\_interval(1s))

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6fbcdb5b11fe6b16784a22d75c914147f6c73580.png)

With #1 and #2, I seem to be having an issue with it subtracting the last polling sum with the current value.

#3  
.es(index=dc1snmp\*,metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2).divide(8).mvavg(30s).yaxis(units=bits/s,max=100000000).label("Ingress x2 WAN").lines(fill=1,width=2).scale\_interval(1s).derivative()

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7bab6bcf2a26a672d655c780643a77f49147155.png)  
I'm kind of surprised because this is a common query and I can't seem to find many examples online of people having it working.

I think this is the closest I've gotten (using derivative), but I'm not sure why I'm getting negative values.  
I've had to divide by 8, it seems like multiplying by 8 for octets -\> bits is giving me inaccurate numbers

Any help is much appreciated!

Thank you

---

<div class="post-metadata">

**Author:** ![kbrown](https://avatars.discourse-cdn.com/v4/letter/k/f475e1/32.png) [@kbrown](https://discuss.elastic.co/u/kbrown)\
**Post date:** [July 9, 2020, 4:48pm UTC](https://discuss.elastic.co/t/timelion-interface-traffic-query/240031/2 "2020-07-09T16:48:29Z")

</div>

I don't want to break any community rules - is it acceptable for me to add a $ bounty to this question?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2020, 4:48pm UTC](https://discuss.elastic.co/t/timelion-interface-traffic-query/240031/3 "2020-08-06T16:48:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.