https://community.splunk.com/t5/Splunk-Search/Timechart-of-max-variable-get-actual-time-of-peak-instead-of-bin/m-p/299359#M90224 <P>When I do a timechart - I get the max of my variable in the chart.</P> <P>However, if I hover over the value - the time associated is the bin time of the timechart and not the actual time of the event.</P> <P>i.e. for a 24 hour search<BR /> timechart max(latency) span=30m</P> <P>If I had an event measuring 1500 at 10:37:45 which was the max in that bin, it will chart 1500, but it will timestamp at 10;30, the beginning of the bin.</P> <P>How do I get it to show the actual event _time ? </P> Fri, 31 Mar 2017 15:22:08 GMT sperl 2017-03-31T15:22:08Z https://community.splunk.com/t5/Splunk-Search/Timechart-of-max-variable-get-actual-time-of-peak-instead-of-bin/m-p/299359#M90224 <P>When I do a timechart - I get the max of my variable in the chart.</P> <P>However, if I hover over the value - the time associated is the bin time of the timechart and not the actual time of the event.</P> <P>i.e. for a 24 hour search<BR /> timechart max(latency) span=30m</P> <P>If I had an event measuring 1500 at 10:37:45 which was the max in that bin, it will chart 1500, but it will timestamp at 10;30, the beginning of the bin.</P> <P>How do I get it to show the actual event _time ? </P> Fri, 31 Mar 2017 15:22:08 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-of-max-variable-get-actual-time-of-peak-instead-of-bin/m-p/299359#M90224 sperl 2017-03-31T15:22:08Z https://community.splunk.com/t5/Splunk-Search/Timechart-of-max-variable-get-actual-time-of-peak-instead-of-bin/m-p/299360#M90225 <P>Give this a try</P> <PRE><CODE>your base search | eventstats max(latency) as max | eval MaxTimestamp=if(latency=max,_time,null()) | timechart span=30m max(latency) as maxLatency values(MaxTimestamp) as MaxTimestamp values(max) as max | appendpipe [| dedup MaxTimestamp max | eval _time=MaxTimestamp | eval maxLatency =max ] | table _time maxLatency | sort _time </CODE></PRE> Fri, 31 Mar 2017 16:19:25 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-of-max-variable-get-actual-time-of-peak-instead-of-bin/m-p/299360#M90225 somesoni2 2017-03-31T16:19:25Z