Get a Time Series in between The Event Times

[linu1988]

Hello Everyone,
I was doing some aggregation with stats, i had to show all the events between 15 minutes interval. The events available are having time according to the file modified date. When i do

"|bucket _time span=15m|Stats sum(FILESIZE)by _time"
i get the desired result and upon the value i get to know whether the file backup was done properly or not.

So My question was to "HOW CAN I GET THE INTERMEDIATE TIMES FOR THE EMPTY EVENTS FROM STARTING TO END TIME,SO THAT I CAN GET NULL FOR THOSE VALUES?

[jtrucks]

Use timechart.

If you mean you want a result for every non-null 15 minute block, do:

search ... | timechart span=15m sum(FILESIZE)

If you need the minutes in between, you can get meta with something like:

search ... | timechart span=15m sum(FILESIZE) as filesum | timechart span=1m filesum

Or maybe:

search ... |bucket _time span=15m|Stats sum(FILESIZE)by _time as filesum| timechart span=1m filesum

You'll have to experiment to get the exact syntax for what you need, but I've used similar types of searches and timechart syntax before to accomplish this.

[linu1988]

Timechart gives me the result but there are too many columns to consider. Any tweak that will only join the empty times between the missing time intervals

[linu1988]

I had thought of using Timechart but with many fields it doesn't give me the result. I want it in a tabular format with other relevant fields along with the sum value.

BTW thank you for the guidance ,but is there any other way by which I can get the whole _time range if the events doesn't have them?