Its the timechart command that does the binning, so no amount of advanced charting voodoo will correct the ranges of data.
The only thing I can think of is something like this :
*
| addinfo
| eval modifier=60*tonumber(strftime(info_min_time,"%M"))
| eval _time=_time-modifier
| timechart span=1h count by sourcetype
| eval _time=_time+[
search *
| head 1
| addinfo
| eval modifier=60*tonumber(strftime(info_min_time,"%M"))
| return $modifier
]
This looks at the minimum time for the search, gets the minute, offsets the data by that much so it snaps to the hour cleanly, does the timechart, then corrects the offset.
The subsearch does depend on you setting the earliestTime in the timerangepicker, and not hardcoding it into the main search.
If you're hardcoding it into the main search, everything becomes much simpler, because you might as well just replace "modifier" with minutes*60
... View more