https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579973#M202079 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241930">@Anita</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 05 Jan 2022 10:07:47 GMT gcusello 2022-01-05T10:07:47Z https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579964#M202073 <P>If I use <STRONG><EM>bin _time as time span=15m | stats count by time</EM></STRONG> on 17:20 for the past 1 hour, the result would be like</P><P>...</P><P>time interval&nbsp; &nbsp; &nbsp; count</P><P>16:45 - 17:00&nbsp; &nbsp; 1285</P><P>17:00 - 17:15&nbsp; &nbsp; 1352</P><P>17:15 - 17:20&nbsp; &nbsp; 362</P><P>So for the last time bucket which is incomplete, there will be only 5 mins data.</P><P>Is there any way to search every 15mins backward from the current time like&nbsp;</P><P>...</P><P>16:35 - 16:50</P><P>16:50 - 17:05</P><P>17:05 - 17:20</P><P>Really appreciate your help!</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 05 Jan 2022 09:28:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579964#M202073 Anita 2022-01-05T09:28:14Z https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579967#M202074 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241930">@Anita</a>,</P><P>you have to use the aligntime=latest in your bin command, something like this:</P><LI-CODE lang="markup">your_search | bin _time as time span=15m aligntime=latest | stats count by time </LI-CODE><P>as you can see at <A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2111/SearchReference/Bin" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.2.2111/SearchReference/Bin</A></P><P>Ciao.</P><P>Giuseppe</P> Wed, 05 Jan 2022 09:37:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579967#M202074 gcusello 2022-01-05T09:37:44Z https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579969#M202076 <P>That works!&nbsp;</P><P>Thank you so much for your help!</P> Wed, 05 Jan 2022 09:53:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579969#M202076 Anita 2022-01-05T09:53:24Z https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579973#M202079 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241930">@Anita</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 05 Jan 2022 10:07:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-every-15mins-with-complete-time-bucket/m-p/579973#M202079 gcusello 2022-01-05T10:07:47Z