https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15034#M1738 <P>Short answer - no you cannot have both, and if you do, the 'span' will win. </P> <P>The longer answer is that technically you can 'bin' other fields besides time. In the timechart below, im setting a span for the _time, but note the bins=3. That is actually telling timechart to bin the <STRONG>date_hour</STRONG> values into numeric ranges. </P> <P><CODE>index=_internal source=*metrics.log group=per_index_thruput series!=_internal | timechart span=1h sum(kb) by date_hour bins=3</CODE></P> Tue, 08 Jun 2010 07:33:45 GMT sideview 2010-06-08T07:33:45Z https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15032#M1736 <P>Can you have both span=x and bins=y in timechart? If both are specified, which one wins?</P> Tue, 08 Jun 2010 05:01:05 GMT https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15032#M1736 kbains 2010-06-08T05:01:05Z https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15033#M1737 <P>It should flag it as an error/warning, but currently it is not. span will win.</P> Tue, 08 Jun 2010 07:29:36 GMT https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15033#M1737 steveyz 2010-06-08T07:29:36Z https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15034#M1738 <P>Short answer - no you cannot have both, and if you do, the 'span' will win. </P> <P>The longer answer is that technically you can 'bin' other fields besides time. In the timechart below, im setting a span for the _time, but note the bins=3. That is actually telling timechart to bin the <STRONG>date_hour</STRONG> values into numeric ranges. </P> <P><CODE>index=_internal source=*metrics.log group=per_index_thruput series!=_internal | timechart span=1h sum(kb) by date_hour bins=3</CODE></P> Tue, 08 Jun 2010 07:33:45 GMT https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15034#M1738 sideview 2010-06-08T07:33:45Z https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15035#M1739 <P>You know what's awesome when you bin fields other than time? logarithmic spans: `index=weblogs | bin responseTime span=1.2log1.6 | stats count by responseTime</P> Tue, 08 Jun 2010 09:51:55 GMT https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15035#M1739 gkanapathy 2010-06-08T09:51:55Z https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15036#M1740 <P>fine. outdo me and get the last word. my mom still thinks im cool.</P> Tue, 08 Jun 2010 12:24:06 GMT https://community.splunk.com/t5/Splunk-Search/using-span-and-bin-in-timechart/m-p/15036#M1740 sideview 2010-06-08T12:24:06Z