topic Re: tstat hourly time span without snapping to hour, relative to start of absolute time range instead in Splunk Search

tstat hourly time span without snapping to hour, relative to start of absolute time range instead

akarollil — Wed, 10 Mar 2021 17:44:38 GMT

Hello,

I am trying to collect stats per hour using a data model for a absolute time range that starts 30 minutes past the hour. The query looks something like:

|tstats count, sum(X), sum(Y) FROM datamodel=ZModel BY _time span=1h

I choose a time range using the Date & Time Range picker, but the range starts at 30 minutes past the hour. So say something like Jan 1 16:30 to Jan 2 16:30. The problem I have is that the time 'buckets' in the result snap to the hour, and so the hourly ranges are like 16:00 - 17:00, 17:00 - 18:00 and so forth rather than 16:30 - 17:30, 17:30 - 18:30 and so forth.

Is there anyway to make the time buckets start off relative to the start time specified rather than snap to the hour? I tried using earliest= latest= instead of using the Date & Time Range picker, but that didn't help either.

Re: tstat hourly time span without snapping to hour, relative to start of absolute time range instead

akarollil — Fri, 12 Mar 2021 17:20:59 GMT

Somebody? Anybody?

Re: tstat hourly time span without snapping to hour, relative to start of absolute time range instead

scelikok — Sat, 13 Mar 2021 10:30:18 GMT

Hi @akarollil,

tstats command cannot do it but you can achieve by using timechart command.

Please try below;

| tstats count, sum(X) as X , sum(Y) as Y FROM datamodel=ZModel BY _time span=30m | timechart span=1h aligntime=@h+30m sum(count) sum(X) sum(Y)

Re: tstat hourly time span without snapping to hour, relative to start of absolute time range instead

akarollil — Mon, 15 Mar 2021 15:17:53 GMT

Thanks a lot @scelikok ! That worked. I think I had seen aligntime but couldn't figure out how to use it with tstats or timechart.

Re: tstat hourly time span without snapping to hour, relative to start of absolute time range instead

scelikok — Mon, 15 Mar 2021 15:33:26 GMT

You're welcome @akarollil

Please accept the answer for community.