# Why count in my line chart shows incorrect value before drill down?

**URL:** <https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911>\
**Category:** Kibana\
**Created:** [April 11, 2017, 4:56am UTC](https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911 "2017-04-11T04:56:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [April 11, 2017, 4:56am UTC](https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911/1 "2017-04-11T04:56:47Z")

</div>

Hi,

I am using ELK GA 5.0.0. I have created a line chart with `Count` in Y-Axis, and `Date Histogram` in X-Axis with timefield interval set to `Second`. The problem I am facing is, when I take it for 4 hours, my chart is showing some values, which is not correct. Below is the image;

 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/b/ebd9e06c234d6a65cd0656d6e4cd8c723b707e0c.png "incorrect value")

In the image, you can see the count as 91.867. The filter total is none other than `*`. Then I narrowed the time range to the peak, like in the image below;

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f9c4bb04a2323cfc495a4f019ae4a7d61b2ea91f.png "drill down")

Now the chart is showing correct count;

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aeb868e524a73b56bb843f87ce71a732021aa57.png "correct chart")

Why is this happening and how can I fix this? Thanks in advance..

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 11, 2017, 5:15am UTC](https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911/2 "2017-04-11T05:15:56Z")

</div>

Setting a 1 second interval for an aggregation across a long time range will generate a very large number of buckets. I suspect Kibana therefore alters the interval automatically. You should be able to check this by looking at the generated aggregation, which can be seen by expanding the statistics view in the lower left corner of the visualisation.

If you are looking for a graph showing per second request rate, I would recommend creating a Timelion sheet that uses the `scale_interval` function (similar to [this thread](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/8)). As Timelion is now part of core Kibana, you can add Timelion sheets to a dashboard.

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [April 11, 2017, 5:21am UTC](https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911/3 "2017-04-11T05:21:27Z")

</div>

OK @Christian_Dahlqvist I have a doubt. I have a `time` field and `@timestamp` in my index. Both are date time fields. They have different values. `time` represents time that events occurred, and I have selected it as the default timestamp field in Kibana. Is this ok to work with timelion? or should i set `time` and `@timestamp` as same (using Logstash)?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 11, 2017, 5:29am UTC](https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911/4 "2017-04-11T05:29:54Z")

</div>

You can specify the `timefield` in the `.es()` function in Timelion. Go to `docs` in the menu in Timelion and look for `.es()` to see a list of all options.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2017, 5:33am UTC](https://discuss.elastic.co/t/why-count-in-my-line-chart-shows-incorrect-value-before-drill-down/81911/5 "2017-05-09T05:33:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.