Thank you, that helps somewhat. Just to make sure my understanding is now correct:
status_buckets is an integer that tells Splunk how many timebuckets it should keep for summary statistics about the extracted fields
Looking through docs, it seems that "time buckets" refers to a number of buckets that each span some time interval, used with certain timeline related commands (ie tstats). Is that the same definition of timebuckets as the one in the quoted portion?
It then proceeds to keep 2 buckets of summary statistics, for all the fields referenced in the search, plus the field "username".
So if status_buckets had been set to 1, or even 10, how would that have affected this output? Based on the above definition of time buckets, I understand that this means the granularity of summary statistics would have been broken down into multiple intervals (ie if status_buckets was 10 and the search time range was 10 hours, there would be 10 hour-long buckets generated)?
