index="myindex" cluster="mycluster" http_request="/"
| bucket _time span=5m
| timechart count by x_forwarded_for useother=false span=5m
the time buckets i'm seeing on this |timechart are half hour buckets instead of 5m buckets. What am I doing wrong?
@zachsisinst I don't think you need line two, because the timechart command takes care of that for you.
timechart seams to be very picky about the location of the span option, try this:
| timechart span=5m count by x_forwarded_for useother=false
Hope this helps ...
it is right here https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart
timechart [sep=<string>] [format=<string>] [partial=<bool>] [cont=<bool>] [limit=<int>]
[agg=<stats-agg-term>] [<bin-options>... ]
( (<single-agg> [BY <split-by-clause>] ) | (<eval-expression>) BY <split-by-clause> )
That said the span= or bin option needs to be on the left side of the by split clause 🙂
See the updated post