Does bucket/bin command work from a lookup table/KVStore?

[splunkrocks2014]

I have a timestamp column, my_time, stored in my kvstore, my_kv. I wanted to generate a report, but I got "No results found."

| inputlookup my_kv | bucket span=1h my_time | timechart count

I wonder if the bin/bucket command works for a lookup or kvstore. If not, are there other solutions? Thanks.

[woodcock · Accepted solution]

Yes, it does. All bin does is round down to the nearest specifier; there is no magic. The problem is that timechart in your case works only on _time so it is ignoring your my_time field. You need | rename my_time AS _time and then it will work.

[splunkrocks2014]

Thank you very much!