How to round search time to 5 mins?
If i use span=5m fro timechart the time rounded to 1 minute looks awful.
I'd also like more details about your question. In the meantime, here's another guess: Are you annoyed by "half buckets" when your time range starts at 12:03 and it sticks those two minutes until 12:05 into a bucket, messing up counts and sums? Try adding partial=f
to your timechart
, it'll discard those buckets.
I'd also like more details about your question. In the meantime, here's another guess: Are you annoyed by "half buckets" when your time range starts at 12:03 and it sticks those two minutes until 12:05 into a bucket, messing up counts and sums? Try adding partial=f
to your timechart
, it'll discard those buckets.
Thanks) partial is enough.
index=_internal earliest=-1h@h latest=-0h@h | timechart span=5m count by source
This sets span as 5m and you get 12 intervals.
If you give more details, it will be helpful to answer your question
You mean you need time in interval of 5 minutes