I'm using timechat to count the number of events per minute in a single value display: search | timechart span=1m count
This works fine. However, each time span is aligned to the top of the minute, meaning that the single value is only ever accurate when the search is conducted at the top of the minute. I want my single value to display the total number of requests in the last minute from now and not the last whole minute.
For example, if the search is running at 12:15:39, the single value should show the count of events between 12:14:39 and 12:15:39, rather than the count from 12:14:00 to 12:15:00 (or, if using partial=true, 12:15:00 to 12:15:39)
Is timechart suitable for this or do I need to use another method?
1) timechart kills the calculated field, so you have to do it all over again, then delete the added fields as well.
2) You can use info_max_time or info_min_time, depending on whether you are more concerned about aligning the start of the period or the end of the period. They are functionally equivalent except for edge cases.