https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43256#M10185 <P>Thanks. This is what I used before and it appears to be working fine. I was just concerned if the timestamps weren't exactly, for example 1:00:30 - 1:01:00 it wouldnt work because some of them vary by 1 second or 2.</P> Thu, 23 May 2013 01:05:49 GMT aaronkorn 2013-05-23T01:05:49Z https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43254#M10183 <P>We have events that are written every 30 seconds and we would like to display these events individually in a timechart with a span of 30 seconds. How would we adjust or snap the timestamp to every 30 seconds?</P> Wed, 22 May 2013 20:50:36 GMT https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43254#M10183 aaronkorn 2013-05-22T20:50:36Z https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43255#M10184 <PRE><CODE> ...| bucket _time span=30s | timechart span=30s ... </CODE></PRE> <P>is what I think you're after.</P> <P>/k</P> Wed, 22 May 2013 21:36:53 GMT https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43255#M10184 kristian_kolb 2013-05-22T21:36:53Z https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43256#M10185 <P>Thanks. This is what I used before and it appears to be working fine. I was just concerned if the timestamps weren't exactly, for example 1:00:30 - 1:01:00 it wouldnt work because some of them vary by 1 second or 2.</P> Thu, 23 May 2013 01:05:49 GMT https://community.splunk.com/t5/Splunk-Search/timestamp-snap-to-30-seconds/m-p/43256#M10185 aaronkorn 2013-05-23T01:05:49Z