topN graph not aggregating on field

[Andythsu (Andy)]

Hello, I'm on Kibana 6.8.0 and was trying with top N graph. The top N doesn't seem to be aggregating on the field. For example,

shows that the red bar sums up to 0, but the time series graph clearly shows that there is a data point (113456) within the time frame. The top N should not aggregate to 0 in this case.

Not sure what I'm missing.

Please advise. Thanks!

[wylie (Wylie Conlon)]

Hi, welcome to the forums! This is not very obvious in Kibana 6.8, but has been improved since Kibana 7.4 was released (over a year ago). In previous versions, TSVB will only visualize the most recent bucket, basically turning the last point in the line chart into a bar chart. In 7.4 we introduced "entire time range mode" which does what you're expecting.

The only workaround in previous versions is to construct your chart using a different editor, like the Bar Chart editor.

[Andythsu (Andy)]

Hello wylie,

Thank you so much for the help! I'm trying to build a top N graph with percentages. Bar Chart editor doesn't quite work because it doesn't allow me to do division. I'm trying to sum total records and sum all "failed" records, and use failed records / all records to get a percentage.

Bar chart doesn't seem to do the summing... in case I'm missing anything. Any advice for that? Thanks!

[wylie (Wylie Conlon)]

You have two options:

1. Upgrade your stack to a more recent version, where the feature you're asking for is supported
2. Built a completely custom visualization using Vega. Since you are on an older version of the stack, you will need to use Vega and not Vega-Lite because Vega supports the flatten transform. The flatten transform is supported in Vega-Lite in Kibana 7.9 and higher. There's a tutorial on a related topic here: https://www.elastic.co/guide/en/kibana/current/vega-tutorial-update-kibana-filters-from-vega.html

[Andythsu (Andy)]

Thanks again @wylie I will give Vega a try