tstat hourly time span without snapping to hour, relative to start of absolute time range instead

[akarollil]

Hello,

I am trying to collect stats per hour using a data model for a absolute time range that starts 30 minutes past the hour. The query looks something like:

|tstats count, sum(X), sum(Y) FROM datamodel=ZModel BY _time span=1h

I choose a time range using the Date & Time Range picker, but the range starts at 30 minutes past the hour. So say something like Jan 1 16:30 to Jan 2 16:30. The problem I have is that the time 'buckets' in the result snap to the hour, and so the hourly ranges are like 16:00 - 17:00, 17:00 - 18:00 and so forth rather than 16:30 - 17:30, 17:30 - 18:30 and so forth.

Is there anyway to make the time buckets start off relative to the start time specified rather than snap to the hour? I tried using earliest= latest= instead of using the Date & Time Range picker, but that didn't help either.

[scelikok]

You're welcome @akarollil

Please accept the answer for community.

[scelikok · Accepted solution]

Hi @akarollil,

tstats command cannot do it but you can achieve by using timechart command.

Please try below;

| tstats count, sum(X) as X , sum(Y) as Y FROM datamodel=ZModel BY _time span=30m 
| timechart span=1h aligntime=@h+30m sum(count) sum(X) sum(Y)

[akarollil]

Thanks a lot @scelikok ! That worked. I think I had seen aligntime but couldn't figure out how to use it with tstats or timechart. 

[akarollil]

Somebody? Anybody?