bucket span not working for lower time span

[shashank_24]

Hi, I have a search but it doesn't seem to work. I need to extract the transaction per second data and for that I was using timechart but it is restricting the rows with below error -

The specified span would result in too many (>50000) rows.

Then i thought of using bucket command with stats but it doesn't seem to work correctly. It doesn't give me the data per second which is actually my requirement. See the below table for output

index=test sourcetype=ssl_access_combined requested_content="/myapp" 
| bucket span=1s _time 
| stats count by _time

_time	count
2020-07-09 00:00:06	1
2020-07-09 00:00:27	1
2020-07-09 00:00:38	1
2020-07-09 00:00:40	1

can someone advice on this? I am not sure why it is happening.

[to4kawa]

sample: try time picker last 7 days

| makeresults [| makeresults  | addinfo | eval count="count=".round(info_max_time - info_min_time) | return $count] | streamstats current=f count | eval _time=_time - count | fields - count
| append [ | tstats count where index=_internal sourcetype=splunkd by _time span=1s]
| fillnull count
| stats max(count) as count by _time

make _time like above. If subsearch result is over 50000, 

| tstats count where index=_internal by _time span=1s
| reverse
| autoregress _time as time
| reverse
| eval time_ex=mvrange(_time,time,1)
| streamstats count as session
| stats values(count) as count by session time_ex
| sort 0 session time
| rename time_ex as _time
| eventstats min(_time) as time by session
| eval count=if(_time=time,count,0)
| fields - session time

[isoutamo]

Hi

your syntax/usage with bucket seems to be correct.

For how long time range you try to run this query with timechart?

r. Ismo

[shashank_24]

@isoutamo I actually needed for longer time like last 7 days which won't work with timechart.

Actually I think i got what's wrong. I was confused about the time gap in the below table but it seems the stats command is only logging the time when there was an event occurred. I was expecting it to work like timechart which shows the every second irrespective of the events occurred

_time	count
2020-07-09 00:00:06	1
2020-07-09 00:00:27	1
2020-07-09 00:00:38	1
2020-07-09 00:00:40	1

[isoutamo]

Actually bucket/bin command groups events within 1s slots based on their _time and if there haven’t been any events in some particular seconds then stats couldn’t calculate for it anything.

Maybe those gaps can filled with makeresults and streamstats? Unfortunately I haven’t splunk on my hand now to test this further.

r. Ismo