"bucket _time span=..." has no affect on search results

[yuelu]

I am trying to group events with same fields and get a count for every 5 minutes interval. I used the following search string:
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | stats count by field1 field2 fields3 field4 | bucket _time span=5m
Instead of returning count for every 5 minutes interval, it returned the total count of all time. Is "bucket _time span=..." not supposed to work with stats?

[stephanefotso · Accepted solution]

Hello! How do you know that your query is returning count every 5 minutes? I think you have to count by _time to know what happen

Try something like this :

   index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m| stats count by field1 field2 fields3 field4 _time

[woodcock]

The "bucket" command needs to come before the "stats" command like this:

index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m | stats count by _time field1 field2 fields3 field4 

[acharlieh]

The bucket command is for taking an existing field value and putting it into discrete sets... in the case of _time, it would alter events to be in 5 minute segments.

Note the timestamp in your results the results between index=example | head 10 and index=example | head 10 | bucket _time span=5m

As time is a field just like everything else, you can bucket first, and then use _time in your stats command like so:

index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m | stats count by _time field1 field2 fields3 field4

(Notice the change of order of commands and the additional by field). Using bucket after stats does nothing since after stats, _time is no longer is present on the results.

You may also be interested in timechart but that would depend as to what you're doing with each of these.