Hm, unfortunately if you are splitting the data, there isn't really a way in timelion to combine the same splits while still offsetting everything.
It makes more sense if you think about how it works without splits: If you were only looking at one value and comparing it with an offset of -1d
, then you would want to see both of those values separately in the legend.
So when you add a split in another query, timelion is still going to separate the values in the legend for you so that each query has a separate legend item... This is even the case if you do the same query twice without an offset: you'll get two entries in the legend.
When you introduce split values, timelion's behavior is still the same: One color-coded item per split item per query. However, since the split values are dynamic and could change from day-to-day, there is no way to guarantee consistency between the two (what's top hit today wasn't necessarily top hit yesterday).
One other thing worth noting -- we do make an attempt to match series like this when using math functions like .divide()
. So if you did something like this, timelion attempts to divide and match up each of the series, but returns an error if for some reason series are different:
.es(index="filebeat-*", timefield=@timestamp,metric=count, split=url.path:5),
.es(index="filebeat-*",timefield=@timestamp, metric=count, split=url.path:5).divide(.es(offset=-1d, index="filebeat-*",timefield=@timestamp, metric=count, split=url.path:5))
This is discussed in a bit more detail in this PR: https://github.com/elastic/kibana/pull/14891
If this functionality is something that would be valuable to you, I'd encourage you to open a feature request with a proposal for what you'd like to see!