Why does the use of timechart give me different results than chart ... by _time?

[krwinters11]

I have done 2 (what I thought were) identical searches.

One ended with:
| timechart first(valueA) as A first(valueB) as B
The other ended with:
| chart first(valueA) as A first(valueB) as B by _time

Why do they produce two different results?
The first one gives me 6 results for valueB where as the second gives me 3 results for valueB over the same 60 day time period.

Thank you in advance.

[aweitzman · Accepted solution]

timechart buckets your results (automatically if you don't override the default) into chunks of time, whereas chart... by _time discretizes your results so that the buckets represent a group of events where each one has the exact same timestamp.

For example, let's say you were charting ten events over a five-day period:

Day 1 1:00 - B=5
Day 1 2:00 - B=7
Day 2 1:00 - B=5
Day 2 2:00 - B=7
Day 3 1:00 - B=5
Day 3 1:00 - B=7
Day 4 1:00 - B=5
Day 4 2:00 - B=7
Day 5 1:00 - B=5
Day 5 2:00 - B=7

Notice on Day 3, the two events happen at the same time.

In the timechart case, it would break this up into five days by default, and give me the first B in each one, so you'd end up with five results, one for each day, each with B=5. In the chart... by _time case, though, since there are nine different values of _time across the ten events, you would get nine results, two each for all the days except Day 3, and one for Day 3.

Hope that helps!