How to control time span in tstats search?

[koshyk]

hi,
I was looking to find more time precise dataset in the last 1 hour

|tstats summariesonly=true count from datamodel=Authentication where earliest=-60m latest=-1m  by _time,Authentication.tag,Authentication.user

This works perfectly, but the _time is automatically bucketed as per the earliest/latest settings. So if I use -60m and -1m, the precision drops to 30secs. If I change it to 24hrs, the precision drops to 30minutes or so. In normal search (like timechart i could use span), but how can we do similar span command in a tstats search?

I could find a question in similar lines, but the answer is not working on the base search which is incorrect.

[harshpatel · Accepted solution]

Have you tried?

|tstats summariesonly=true count from datamodel=Authentication by _time,Authentication.tag,Authentication.user span=60m

[koshyk]

Thanks for that. I've put span almost at every word except at the end 🙂
This solved the problem. Cheers