How can I set bin _time value based on different fields?

[whitefang1726]

I want to run a search query but the _bin span value will change based on the field values.
Example:

Instead of using this, 

index=main sourcetype=test (host=hostnameA OR hostnameB OR hostnameC) 
| bin _time span=1h
| stats count by _time, host

for hostnameA -> I want the span value to be every 10m
for hostnameB -> every 30m
for hostnameC -> every 1h

Thanks!

[ITWhisperer]

All bin is doing is rounding down _time to the nearest span. You can do this yourself with a simple bit of maths. Here is a run-anywhere example, using gentimes to create some event, and random to assign hosts to the events, then calculating the interval between the start and each event time, rounding this down to the nearest span (dependent on the host), and adding that back to the start time. This aligns to the bins to the start time. You could do something similar if you want to align to the end time, or if you wanted even the middle time.

| gentimes start=-1 increment=10s 
| rename starttime as _time 
| fields _time
| eval host=mvindex(split("ABC",""),random() %3)


| eval span=case(host="A",10*60,host="B",30*60,host="C",60*60)
| eventstats min(_time) as start
| eval bucket=floor((_time-start)/span)*span
| eval _time=start+bucket
| stats count by _time host

[whitefang1726]

Nice, that works, I usually used append to add fields , never thought it would work on events as a rows. Thanks, big help @manjunathmeti !

[manjunathmeti]

You're welcome! Please upvote and accept the answer.

[manjunathmeti]

hi @whitefang1726,

You can count events for each host separately and use append to combine them.

index=main sourcetype=test host=hostnameA 
| bin _time span=10m
| stats count by _time, host
| append 
    [ search index=main sourcetype=test host=hostnameB
    | bin _time span=30m 
    | stats count by _time, host] 
| append 
    [ search index=main sourcetype=test host=hostnameC 
    | bin _time span=1h 
    | stats count by _time, host]

If this reply helps you, a like would be appreciated.