timestamp snap to 30 seconds

[aaronkorn]

We have events that are written every 30 seconds and we would like to display these events individually in a timechart with a span of 30 seconds. How would we adjust or snap the timestamp to every 30 seconds?

[kristian_kolb]

 ...| bucket _time span=30s | timechart span=30s ...

is what I think you're after.

/k

[aaronkorn]

Thanks. This is what I used before and it appears to be working fine. I was just concerned if the timestamps weren't exactly, for example 1:00:30 - 1:01:00 it wouldnt work because some of them vary by 1 second or 2.