Feature request : use the results of a terms facet to populate a stacked histogram

[dav3860]

Currently if we want to make a stacked histogram, we need to link it to a multi-query search control and add each search manually. It would be cool if Kibana 3 could determine automatically the top values or terms of a field using a terms facet over the selected timerange, and use it to populate a stacked histogram.

[rashidkpc]

Related to #44

[dwinter3]

I like the idea of stacking the top x, where the user can define how many x is, then grouping the rest in "other". Hope that helps.

Otherwise you can end up with too many stacks in a single columns, making it unreadable.

[chris-walker]

This would make the multi-search feature a heck of a lot more useful for discovering events. As well as graphing the top X events it would be useful to be able to graph the bottom X (least common) events over time.

[rashidkpc]

Just added this in the form of the "derivequeries" panel. It takes a query, a field and count, uses that to generate a multi-query event which can be received by both the histogram panel and the hits panel (eg, in bar, pie or list mode)

[dwinter3]

Looks awesome. Thanks! We will test soon!

Sent from my iPhone

On May 15, 2013, at 7:15 PM, Rashid Khan notifications@github.com wrote:

Just added this in the form of the "derivequeries" panel. It takes a query, a field and count, uses that to generate a multi-query event which can be received by both the histogram panel and the hits panel (eg, in bar, pie or list mode)

—
Reply to this email directly or view it on GitHub.

[dav3860]

Thank you. It looks great.

[dav3860]

Rashid, just a question : how does the derivequeries panel affect the other panels if in the same group (I mean except histograms and hits) ? It looks like if I replace the primary stringqueries panel with a derivequeries panel, the table panel only displays the events with a "top X" value. But when I filter the table view (in the details pane), the query in the derivequeries panel input box becomes incoherent.

[rashidkpc]

Admittedly, derivequeries is really targeted at panels that support multiple queries. In fact, I should probably disable its ability to receive 'query' events as you're right, they don't make any sense.

[dejongm]

Is there a way to make a derived query persistent? I want to setup a histogram that always displays the latest counts for variables in a particular field. It seems derivequeries only acts on user input. Is this true?

[Gabe82]

Hi rashidkpc, how can I add field "field" to field QUERY because i tried with derivequeries but I wasn't able to do nothing.

I'm using Kibana3 milestone 3

Thanks in advance.

[patrickwolf]

Is this already implemented in the latest version of Kibana? And if not how can I add it to our install please? Thanks!