Using _time as a discriminator without time span?

[szabados]

I want to use the _time field as one of my discriminator fields in a tstats command. I wasn't able to figure out, how to do this, without the time values being rounded/group in some time stamp.
For other fields, when used as discriminators every existing value is displayed as a separate row, but with _time, even if I'm no using any span= with my command, they are grouped somehow.
Obviously, in this case, I have really rare events, that's why I want to have the exact time values here.

[andre_tucker]

You could add _time as a field in the by clause and then specify span=1s. I have seen some instances where by default tstats will use 1 day as the span instead of 1 second. If you need to get more granular than 1 second then you may want to rethink using tstats.

[DalJeanis]

How infrequent? The purpose of tstats is that it works on summary data, not individual events. If it is extremely infrequent, then you can use the tstats as an index to the actual events, but if anything else in the event is a sparse indexed field, then that might be a better way to cull the data through the automatic bloom filters.

[DalJeanis]

@szabados - is this still an issue?