Tstats command with span

[Harikiranjammul]

I am running tstats command with span of 2hrs for index and source.

It returns the data for every 2hrs.

But I want to include the results only if it's available for every 2hrs in last 24hrs search.

So basically which is not having continuous data, want to ignore it.

How can I do this.

[livehybrid]

Hi @Harikiranjammul 

Edit - I see there have been other posts since I opened this thread but hopeful;ly this helps someone in the future or provides another option!

How about the following?

| tstats count 
    WHERE 
    earliest=-24h@h latest=@h index=* AND source=* 
    BY _time span=2h, index, source 
| stats dc(_time) as num_buckets  BY index, source
|where num_buckets = 12

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@Harikiranjammul 

[Harikiranjammul]

Thanks. Probably this helps

[bowesmana · Accepted solution]

Is this the sort of thing you are looking for?

| tstats count by index source _time span=2h
| stats list(count) as counts dc(_time) as frequency list(_time) as times by index source
| where frequency>=12