How to remove unfinished buckets from "bin" command

[rohitmaheshwari]

I am using a bin command on _time field to have 10 minute sections of data. Like below:

|bin _time span=10m minspan=10m | stats sum(myField) as myField by _time
|streamstats avg(myfield) as avg by another field

I am trying to compare the most current value in the completed 10 minute block with the average of 10 minute blocks of data.
My understanding is that span should create 10 minute buckets on the data and minspan should filter out buckets that are not 10 minute yet. So if right now its 10.25 then the bucket that is for 10.20 should not be created. But that is not the case, I am getting the 10.20 bucket that has partial values data comparing to the average.

Any workaround or a better options or a much efficient way of doing this will be very helpful.

Thanks in advance!!

[Richfez]

OK I thought there was a way to tell what each time slot was, and by that you could then dump any that weren't the right length.

But I couldn't find that.

So I decided to cut and run, let's use transaction which has an option to do exactly what you want.

...| timechart partial=false sum(myField) as myField|streamstats avg(myfield) as avg by another field

That partial=false should get rid of the trailing, partially filled timeslot.
(and obviously, you don't need bin any more since timechart does binning by itself.

Happy Splunking!
-Rich