my search looks like this ... | fields _time fieldname |
eval wday = strftime(_time, "%a") | where wday = "Thu" | fields - wday | timewrap d series=exact |
1/
my serach produces this earliest =-15d@w1 latest =+8d@w1
but there is 3 values in each 5min slot, but they do not come in at the same time in that 5min slot.
That is why I use the partial=false, to not show this data/time point until it has all the 3 values
But partial=false does not work in this instance. it does in the below exampl
2/
my serach produces this earliest =-15d@w1 latest =now
note the same graph as above except for the latest change. but the partial=false works here and does not show this data/time point until it has all the 3 values.
Anyway I can get timechart, partial=false to work in my example 1 above?
Or do you need more information?
tks
