get data by time

[Learner]

hi all, in my original search im getting data by folloing command:

| stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime

but now, i want this data on hourly basis. so i tried the following script: 

 |bin _time span=1d |eval Time=strftime(_time , "%d/%m/%Y %H:%M")| stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime by Time

 but this gives me 0 value. i'm seeking for the right way to get data on hourly basis. 

[richgalloway]

The bin command rounds off _time values to the day so all events that happen on the same day will have the same timestamp (2020-12-08T00:00:00 today, for example).  The range(_time) function will return 0 on any given day.

To get hourly data, however, one should use span=1h rather than span=1d and use _time in the by clause of the final stats.