I have two visualizations that are setup to count the unique number of IPs in a given field. TSVB shows one number that is significantly higher than Metric does. Below is an example followed by my settings for each visualization. Can someone explain what's going on and where I am wrong at?
TSVB Metric
Metric
It looks like you are applying a Cumulative Sum to the cardinality in TSVB, but not in Visualize. This would explain the different counts.
As far as I'm aware, you can't do that in the metric visualization. In addition, the goal is to show the unique number of terms over the given time range....so which visualization is properly configured to reflect that number?
Both TSVB and Visualize can be configured correctly to show the unique values in your entire timerange. TSVB uses time buckets for all metrics unless you specifically tell it not to using the Panel Options -> Data timerange mode -> Entire time range (instead of "Last value")
What the cumulative sum was doing in your configuration was adding up the # of uniques per date interval, which is not the same thing as # of uniques in the whole range.
I suspect that you will be better served by creating a Visualize metric because of this default behavior of TSVB.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
