https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508539#M2550 <P>sample: try&nbsp;<EM>time picker last 7 days</EM></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults [| makeresults | addinfo | eval count="count=".round(info_max_time - info_min_time) | return $count] | streamstats current=f count | eval _time=_time - count | fields - count | append [ | tstats count where index=_internal sourcetype=splunkd by _time span=1s] | fillnull count | stats max(count) as count by _time</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>make <STRONG>_time</STRONG> like above. If subsearch result is over 50000,&nbsp;<BR /><BR /></P><LI-CODE lang="markup">| tstats count where index=_internal by _time span=1s | reverse | autoregress _time as time | reverse | eval time_ex=mvrange(_time,time,1) | streamstats count as session | stats values(count) as count by session time_ex | sort 0 session time | rename time_ex as _time | eventstats min(_time) as time by session | eval count=if(_time=time,count,0) | fields - session time</LI-CODE> Fri, 10 Jul 2020 20:06:38 GMT to4kawa 2020-07-10T20:06:38Z https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508462#M2539 <P>Hi, I have a search but it doesn't seem to work. I need to extract the transaction per second data and for that I was using timechart but it is restricting the rows with below error -</P><P><STRONG>The specified span would result in too many (&gt;50000) rows.</STRONG></P><P>Then i thought of using bucket command with stats but it doesn't seem to work correctly. It doesn't give me the data per second which is actually my requirement. See the below table for output</P><LI-CODE lang="markup">index=test sourcetype=ssl_access_combined requested_content="/myapp" | bucket span=1s _time | stats count by _time</LI-CODE><P>&nbsp;</P><LI-CODE lang="markup">_time count 2020-07-09 00:00:06 1 2020-07-09 00:00:27 1 2020-07-09 00:00:38 1 2020-07-09 00:00:40 1</LI-CODE><P>&nbsp;</P><P>can someone advice on this? I am not sure why it is happening.</P> Fri, 10 Jul 2020 11:00:35 GMT https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508462#M2539 shashank_24 2020-07-10T11:00:35Z https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508471#M2542 <P>Hi</P><P>your syntax/usage with bucket seems to be correct.</P><P>For how long time range you try to run this query with timechart?</P><P>r. Ismo</P> Fri, 10 Jul 2020 12:34:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508471#M2542 isoutamo 2020-07-10T12:34:31Z https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508474#M2543 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/214410">@isoutamo</a>&nbsp;I actually needed for longer time like last 7 days which won't work with timechart.</P><P>Actually I think i got what's wrong. I was confused about the time gap in the below table but it seems the stats command is only logging the time when there was an event occurred. I was expecting it to work like timechart which shows the every second irrespective of the events occurred</P><LI-CODE lang="markup">_time count 2020-07-09 00:00:06 1 2020-07-09 00:00:27 1 2020-07-09 00:00:38 1 2020-07-09 00:00:40 1</LI-CODE><P>&nbsp;</P> Fri, 10 Jul 2020 12:50:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508474#M2543 shashank_24 2020-07-10T12:50:23Z https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508481#M2545 <P>Actually bucket/bin command groups events within 1s slots based on their _time and if there haven’t been any events in some particular seconds then stats couldn’t calculate for it anything.</P><P>Maybe those gaps can filled with makeresults and streamstats? Unfortunately I haven’t splunk on my hand now to test this further.</P><P>r. Ismo</P> Fri, 10 Jul 2020 13:25:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508481#M2545 isoutamo 2020-07-10T13:25:58Z https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508539#M2550 <P>sample: try&nbsp;<EM>time picker last 7 days</EM></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults [| makeresults | addinfo | eval count="count=".round(info_max_time - info_min_time) | return $count] | streamstats current=f count | eval _time=_time - count | fields - count | append [ | tstats count where index=_internal sourcetype=splunkd by _time span=1s] | fillnull count | stats max(count) as count by _time</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>make <STRONG>_time</STRONG> like above. If subsearch result is over 50000,&nbsp;<BR /><BR /></P><LI-CODE lang="markup">| tstats count where index=_internal by _time span=1s | reverse | autoregress _time as time | reverse | eval time_ex=mvrange(_time,time,1) | streamstats count as session | stats values(count) as count by session time_ex | sort 0 session time | rename time_ex as _time | eventstats min(_time) as time by session | eval count=if(_time=time,count,0) | fields - session time</LI-CODE> Fri, 10 Jul 2020 20:06:38 GMT https://community.splunk.com/t5/Splunk-Enterprise/bucket-span-not-working-for-lower-time-span/m-p/508539#M2550 to4kawa 2020-07-10T20:06:38Z