TSVB Metric shows different value than Metric

[wwalker (Walker)]

I have two visualizations that are setup to count the unique number of IPs in a given field. TSVB shows one number that is significantly higher than Metric does. Below is an example followed by my settings for each visualization. Can someone explain what's going on and where I am wrong at?

TSVB Metric

Metric

[wylie (Wylie Conlon)]

It looks like you are applying a Cumulative Sum to the cardinality in TSVB, but not in Visualize. This would explain the different counts.

[wwalker (Walker)]

As far as I'm aware, you can't do that in the metric visualization. In addition, the goal is to show the unique number of terms over the given time range....so which visualization is properly configured to reflect that number?

[wylie (Wylie Conlon)]

Both TSVB and Visualize can be configured correctly to show the unique values in your entire timerange. TSVB uses time buckets for all metrics unless you specifically tell it not to using the Panel Options -> Data timerange mode -> Entire time range (instead of "Last value")

What the cumulative sum was doing in your configuration was adding up the # of uniques per date interval, which is not the same thing as # of uniques in the whole range.

I suspect that you will be better served by creating a Visualize metric because of this default behavior of TSVB.

[wwalker (Walker)]

hmm...I don't have that, I'm running Kibana 7.2.0 on a basic license, if that matters.