What does bin _time span does here?

[sangs8788]

Hi,

I am having a bit of difficulty understanding what does bin _time span does here. Below is query shared in splunk community to find request per min by OrgName per day

index=data earliest = -1d| bin _time span=1d
 | streamstats count as Req by OrgName, _time
 | eval requestsPerMin=Req/24/60
 | eval requestsPerSec=requestsPerMin/60
 | stats avg(requestsPerMin) as avgRequestPerSec, max(requestsPerMin) as peakRequestPerMin by OrgName, _time

My confusion here is what bin _time span does. I want to find requestPerMin for Last week and month wise too. Could you someone explain how it can be done?

[teunlaan · Accepted solution]

With bin _time span you force the _time to be a full day.
So with | bin _time span=1d you get your stats count split by day.

It you want a report it over a week, just do span=1w a moth is span=1mon (do also change the earlies= value )