I was looking to find more time precise dataset in the last 1 hour
|tstats summariesonly=true count from datamodel=Authentication where earliest=-60m latest=-1m by _time,Authentication.tag,Authentication.user
This works perfectly, but the _time is automatically bucketed as per the earliest/latest settings. So if I use -60m and -1m, the precision drops to 30secs. If I change it to 24hrs, the precision drops to 30minutes or so. In normal search (like timechart i could use span), but how can we do similar span command in a tstats search?
I could find a question in similar lines, but the answer is not working on the base search which is incorrect.