https://community.splunk.com/t5/Splunk-Search/timechart-Trying-to-bucket-by-10-minutes-Displaying-every-minute/m-p/316718#M94763 <P>Hi,</P> <P>I am doing the following:<BR /> index=wineventlog user="*.ad" TaskCategory="Security Group Management" |bucket _time span=10m| timechart count AS EventCount</P> <P>It is showing a report line for every minute - I would like for it to have a report line for every 10 minutes and I thought that the |bucket _time span=10m would do that.</P> <P>How can I get this to display results for every 10 minutes?</P> <P>Thanks in advance</P> Wed, 19 Jul 2017 13:06:35 GMT TheJagoff 2017-07-19T13:06:35Z https://community.splunk.com/t5/Splunk-Search/timechart-Trying-to-bucket-by-10-minutes-Displaying-every-minute/m-p/316718#M94763 <P>Hi,</P> <P>I am doing the following:<BR /> index=wineventlog user="*.ad" TaskCategory="Security Group Management" |bucket _time span=10m| timechart count AS EventCount</P> <P>It is showing a report line for every minute - I would like for it to have a report line for every 10 minutes and I thought that the |bucket _time span=10m would do that.</P> <P>How can I get this to display results for every 10 minutes?</P> <P>Thanks in advance</P> Wed, 19 Jul 2017 13:06:35 GMT https://community.splunk.com/t5/Splunk-Search/timechart-Trying-to-bucket-by-10-minutes-Displaying-every-minute/m-p/316718#M94763 TheJagoff 2017-07-19T13:06:35Z https://community.splunk.com/t5/Splunk-Search/timechart-Trying-to-bucket-by-10-minutes-Displaying-every-minute/m-p/316719#M94764 <P>You need to put the span argument directly in the <CODE>timechart</CODE> command. Otherwise, it recalculates a span based on your search period.</P> <P>New search to try:</P> <P><CODE>index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count AS EventCount</CODE></P> Wed, 19 Jul 2017 13:09:16 GMT https://community.splunk.com/t5/Splunk-Search/timechart-Trying-to-bucket-by-10-minutes-Displaying-every-minute/m-p/316719#M94764 rjthibod 2017-07-19T13:09:16Z