using span and bin in timechart

[kbains]

Can you have both span=x and bins=y in timechart? If both are specified, which one wins?

[steveyz · Accepted solution]

It should flag it as an error/warning, but currently it is not. span will win.

[sideview · Accepted solution]

Short answer - no you cannot have both, and if you do, the 'span' will win.

The longer answer is that technically you can 'bin' other fields besides time. In the timechart below, im setting a span for the _time, but note the bins=3. That is actually telling timechart to bin the date_hour values into numeric ranges.

index=_internal source=*metrics.log group=per_index_thruput series!=_internal | timechart span=1h sum(kb) by date_hour bins=3

[sideview]

fine. outdo me and get the last word. my mom still thinks im cool.

[gkanapathy]

You know what's awesome when you bin fields other than time? logarithmic spans: `index=weblogs | bin responseTime span=1.2log1.6 | stats count by responseTime

[steveyz · Accepted solution]

It should flag it as an error/warning, but currently it is not. span will win.