Why does tstats command alter time stamps when I run it by _time?

[LIS]

I am wondering why tstats command alters time stamps when I run it by _time.

| tstats values(text_len) as text_len  values(ts) as ts where index = data sourcetype = cdr by _time thread_id num_attempts

raw data in index=data :  

Time

_time

2023-03-22T13:14:16.000+01:00

After tstats:

2023-03-22 13:10:00

[richgalloway · Accepted solution]

To group events by _time, tstats rounds the _time value down to create groups based on the specified span.  If no span is specified, tstats will pick one that fits best in the time window search - 10 minutes in this case.

[LIS]

Hi @richgalloway 

Thank you for your response. But in my case there are no groups, because i used also another field (id) in by section, which is unique. So I expected to see all events with their original timestamps.

[bowesmana]

tstats by _time supports the span= argument, so you can do span=1s to get the a 1 second bucket of _time

[yeahnah]

Hi @LIS 

@richgalloway  is correct, it's due to grouping by the _time field.

If you do want to pull the original _time out of the event then do not group by _time but pull it out as a field value, e.g.

| tstats max(_time) AS _time values(text_len) as text_len  values(ts) as ts where index = data sourcetype = cdr by thread_id num_attempts 

 This assumes that each event has a unique thread_id and num_attempts, but hopefully this demonstrates the difference in what you expected.

[richgalloway]

tstats still would have modified the timestamps in anticipation of creating groups.  It wouldn't know that would fail until it was too late.

If this was a stats command then you could copy _time to another field for grouping, but I don't know of a way to do that with tstats.