https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669250#M54766 <P>I have created a dashboard in dashboard studio. I have a table visualization, see my code below.&nbsp;<BR /><BR />So, the "Time" column auto sets my | bin to one minute. When I update my timepicker to say the last 7 days it still shows the time |bin as one minute.&nbsp;</P><P>How can I dynamically change the |bin to best fit my timepicker selection?</P><P>&nbsp;</P><LI-CODE lang="markup">| search cat IN ($t_endpoint$) AND Car IN ($t_car$) | eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p") | stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by Time, Car, cat</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Mon, 20 Nov 2023 20:15:37 GMT MrJohn230 2023-11-20T20:15:37Z https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669250#M54766 <P>I have created a dashboard in dashboard studio. I have a table visualization, see my code below.&nbsp;<BR /><BR />So, the "Time" column auto sets my | bin to one minute. When I update my timepicker to say the last 7 days it still shows the time |bin as one minute.&nbsp;</P><P>How can I dynamically change the |bin to best fit my timepicker selection?</P><P>&nbsp;</P><LI-CODE lang="markup">| search cat IN ($t_endpoint$) AND Car IN ($t_car$) | eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p") | stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by Time, Car, cat</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Mon, 20 Nov 2023 20:15:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669250#M54766 MrJohn230 2023-11-20T20:15:37Z https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669260#M54769 <P>Converting the time to a string is a peculiar way to do binning. I'd rather simply use the bin command with a proper set of parameters for binning.</P><P>If you want to display your time in a human-readable form you can still do fieldformat.</P> Mon, 20 Nov 2023 22:11:48 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669260#M54769 PickleRick 2023-11-20T22:11:48Z https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669357#M54781 <P>This is what worked for me. I added a TimeBucket dropdown box and created a token.&nbsp;</P><LI-CODE lang="markup">| search cat IN ($t_endpoint$) AND Car IN ($t_car$) |bin _time span=$t_bin$ | stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by _time, Car, cat | eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p") |fields - _time |fields Time, Numbercat</LI-CODE><P><BR /><BR /><BR /><BR /></P> Tue, 21 Nov 2023 15:52:06 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Stats-Auto-Bin-Time/m-p/669357#M54781 MrJohn230 2023-11-21T15:52:06Z