The only situation that timechart seems to be doing strange things is when _time is outside of your search range. For example:
| makeresults count=10
| streamstats count
| eval _time=_time+7200*count
| timechart span=1h count
It indeed aligns the results to the full hours for which there is data.
If you run this search with any "past" time range chosen from the time picker, it will give you results spread over 2-hour span. If you chose "any time" however, you'll get proper 1-hour spans with alternating 0 and 1 values.
It looks like a bug.
Hmm, it's hard to believe since it's span's function to define the... span size.
Can you show us the results of:
<<your_search_with_timechart>>
| autoregress _time as oldtime
| eval diff=_time-oldtime
| stats count by diff
count is 11 and diff 7200
The only situation that timechart seems to be doing strange things is when _time is outside of your search range. For example:
| makeresults count=10
| streamstats count
| eval _time=_time+7200*count
| timechart span=1h count
It indeed aligns the results to the full hours for which there is data.
If you run this search with any "past" time range chosen from the time picker, it will give you results spread over 2-hour span. If you chose "any time" however, you'll get proper 1-hour spans with alternating 0 and 1 values.
It looks like a bug.