Timelion top 5 not working compared to TSVB top 5

Hi, I have this top 5 interfaces based on the average of utilization, in TSVB last 24 hours

But when I try to do the same in canvas using Timelion with this query

.es(q='tenant name.keyword : LABSAV',index='metric-interface*',
    timefield='@timestamp', split=q_interface_name.keyword:5,metric=avg:utilization).label(regex='.*q_interface_name\.keyword:(.*) > .*',label='$1')

I get a different graph, with other interfaces as a top 5

what Im doing wrong?

I tried a setup pretty close to yours, and I don't see the issue that you are getting.

When you view the TSVB chart, are you applying the tenant name.keyword : LABSAV filter?

yes, it has that filter....could be the timezone? seems that in cavas shows the data in UTC

Is the TSVB chart also embedded in the Canvas worksheet when you see the problem?

Hi Tsullivan, I didnt even know this was possible...no its not embedded.....I have just realized that theres a embed object button in canvas, but when I click on it no object is listed, and I have many visualizations....its only for maps? in kibana 7.6

In 7.6, Maps are the only visualization type that can be embedded. I believe 7.7 allowed all the other visualizations including TSVB.

There are a few timezone-related timelion issues in Canvas right now. This is possibly related: Timelion query not respecting timezone parameter · Issue #67751 · elastic/kibana · GitHub

Like Corey mentioned above, hopefully a possible workaround could be upgrading and using the TSVB visualization directly in your workpad

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.