# Visualization - compare data in a time range over days/weeks/months

**URL:** <https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099>\
**Category:** Kibana\
**Created:** [November 8, 2015, 5:30am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099 "2015-11-08T05:30:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [November 8, 2015, 5:30am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/1 "2015-11-08T05:30:57Z")

</div>

Hi all,

I'm using ELK to store and graph Netflow data. I've created some line charts such as Flow over time, throughput over time, packets over time. What I need is to be able to compare data in a time range over days, weeks, or months.

For example, I want to see how many packets between 4pm and 5pm of today compared to yesterday or other previous days of the week, compare data of Monday to those of previous Monday of weeks.

The idea is to identify abnormal traffic based on Netflow throughput or packets over time. Let's say I'm looking at traffic for Thursday at 2pm. A high number of packets at 2pm does not necessarily mean an abnormal traffic if same number of packets occurred on Wednesday or Tuesday. A high value from the baseline is considered normal if it occurs during business hours or just because a program is scheduled to run at that time everyday or every weekday.

I wonder if Kibana has this feature or will support it in the future since it would be nice to create a baseline of data then identify the outliers

Thanks,  
Anh

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 9, 2015, 12:19am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/2 "2015-11-09T00:19:58Z")

</div>

It currently does this by looking at longer timeframes as the time picker applies to the entire dashboard.

There may be a FR to allow per viz timeframes, but if not feel free to raise one!

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [November 9, 2015, 4:47am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/3 "2015-11-09T04:47:06Z")

</div>

Yes, but at a longer time frame, the time interval will also change like from 30 mins to every hour, every 3 hours, or every day, which again makes it hard to point out the outliers.

---

<div class="post-metadata">

**Author:** ![mrvincnezo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrvincnezo/32/10829_2.png) [@mrvincnezo](https://discuss.elastic.co/u/mrvincnezo)\
**Post date:** [July 20, 2016, 7:20am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/4 "2016-07-20T07:20:06Z")

</div>

I wonder if ELK 5 stack will include a per viz timeframe support.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 20, 2016, 8:03am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/5 "2016-07-20T08:03:30Z")

</div>

Not that I know of.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [July 21, 2016, 4:53am UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/6 "2016-07-21T04:53:11Z")

</div>

I know that Grafana dashboard supports time shift which does exactly what I need, but it's pretty limited in term of data exploring compared to Kibana. I hope that time shift ( -24h, -7day, - 1month) can be added to each Kibana visualization in future release.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/visualization-compare-data-in-a-time-range-over-days-weeks-months/34099/7 "2017-07-06T13:45:19Z")

</div>


