How can I create a time chart grouping the data per 5 minutes, but showing every minute?

[ocnarb]

Example:

_time---value---group
00:01------2---------2
00:02------3---------5
00:03------4---------9
00:04------2---------11
00:05------3---------14
00:06------1---------13
00:07------2---------12
00:08------1---------9
00:09------1---------8
00:10------2---------7

[to4kawa]

| makeresults 
| eval _raw="_time,value,group
00:01,2,2
00:02,3,5
00:03,4,9
00:04,2,11
00:05,3,14
00:06,1,13
00:07,2,12
00:08,1,9
00:09,1,8
00:10,2,7"
| multikv
| eval _time=strptime(time,"%H:%M")
| table _time,value,group
| rename COMMENT as "this is sample data you provided"
| rename COMMENT as "From now on, I will verify your desired behavior."
| timechart cont=f span=5m sum(value) as value by group

Hi, @ocnarb

I did it using multiple searches of 5 minutes and joining them per minute,

If you provide your query, it can be improved.
maybe , you do not need to join because it is slow.

[richgalloway]

When timechart groups events by time, the specific time information is lost so it's not possible to show every minute. The same is true of the bin command.

If you explain your use case, there may be another way.

[ocnarb]

Thanks rich.

I did it using multiple searches of 5 minutes and joining them per minute, it was messy and super slow, but it worked. I did something like this:

1st search: from now to -5m
2nd search: from -1m to -6m
3rd search: from -2m to -4m
4th search: from -3m to -8m
...

I thought there was a better and faster way of doing it via timechart.

I will adjust the thresholds and use a timechart with a span of 1 minute.

Thanks again for the attention.

[bowesmana]

I expect you could use a couple of streamstats commands with two different time windows to generate aggregations without losing the data as you would with timechart, stats or bin.

Not sure what your 5 minute grouping is expected to look like though, as I don't understand your group example above.