timechart span not working

[zachsisinst]

index="myindex" cluster="mycluster" http_request="/"
| bucket _time span=5m
| timechart count by x_forwarded_for useother=false span=5m

the time buckets i'm seeing on this |timechart are half hour buckets instead of 5m buckets. What am I doing wrong?

[efavreau]

@zachsisinst I don't think you need line two, because the timechart command takes care of that for you.

[MuS]

Hi zachsisinst,

timechart seams to be very picky about the location of the span option, try this:

 | timechart span=5m count by x_forwarded_for useother=false 

Hope this helps ...

cheers, MuS

UPDATE:

it is right here https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart

timechart [sep=<string>] [format=<string>] [partial=<bool>] [cont=<bool>] [limit=<int>]
[agg=<stats-agg-term>] [<bin-options>... ]
( (<single-agg> [BY <split-by-clause>] ) | (<eval-expression>) BY <split-by-clause> )
[<dedup_splitvals>]

That said the span= or bin option needs to be on the left side of the by split clause 🙂

cheers, MuS

[MuS]

See the updated post

cheers, MuS