Seems my previous comment was lost. I repeat it, sorry for possible double in result. Iguinn, thank for the answer. But does it mean, that I can use «partial» only when I do search with «latest» command in search parameters? In other words, why cannot I use «partial» for request like this?: source="*users.csv" | timechart span=month count as users I do this search in a file which contains data from 2012-06-19 14:53:41 to 2016-06-16 05:39:34. So from business domain point of view «2012-06» bin is a partial one. At the same time timechart creates the first bin for the period from «2012-06-01 00:00:00» to «2012-07-01 00:00:00», and it seems that from timechart’s point of view this bin is not partial. So again - is it possible to use «partial» option in my situation? ... View more

Iguinn, thanks for the answer, but it turned out that I don't understand is it possible for me to use "partial" in my situation. Could you please comment this: I do this request: source="*users.csv" | timechart span=day count as users A file I work with contains data from 2012-06-19 14:53:41 to 2016-06-16 05:39:34. Timechart does bins of 1 days long AND the boundaries of every bean are from 00:00:00 of a the day and 00:00:00 of the next day. E.g. the boundaries for the first bin are "2012-06-19 00:00:00 to 2012-06-20 00:00:00", according to UI of the Splunk (please see the screenshot ). And this time boundaries are set regardless of the time of the day I make a request at. The same situation is for month span-lengh AND for hour span-lengh (I mean that the start and the end of a bin are from appropriate "zero level" of a bean, e.g. for hour it is 00:00). In my situation the intuitive behaviour of "partial" would be just cut off the first and last bins. Because, base on the data in a file, I suspect that it is possible that not all the data for that day are in the file, and for month span I'm sure that it is the case. ... View more

I understood the principle of "partial" working exactly as maciep, and I don't see anything opposite in documentation. The only suspicious thing is that it is said in the documentation that «Only the first and last bin can be partial.». As far as I understand, the first and the last bins have always be consider as partial. Otherwise the system has to have some logic to understand where the first or/and last bins are partial or not. And IMHO this is impossible, because the software cannot understand whether e.g. the first period is incomplete, or there just really weren’t any events during the first part of this first bean. The same issue is here: https://answers.splunk.com/answers/432520/why-is-timechart-partialfalse-still-returning-part.html https://answers.splunk.com/answers/418447/how-is-the-partial-flag-supposed-to-work-with-time.html So it would be great to solve that issue. ... View more

It doesn't work in my case... ... View more

As far as I understand: 1. "Use the bin command for only statistical operations that the chart and the timechart commands cannot process." - that's said in doc for "bin" command. 2. Bin command itself doesn't have partial option. 3. Bin option in timechart command specifies only the number of resulting beans, nothing else. I understood the principle of "partial" working exactly as maciep, and I don't see anything opposite in documentation. The only suspicious thing is that it is said in the documentation that «Only the first and last bin can be partial.». As far as I understand, the first and the last bins have always be consider as partial. Otherwise the system has to have some logic to understand where the first or/and last bins are partial or not. And IMHO this is impossible, because the software cannot understand whether e.g. the first period is incomplete, or there just really weren’t any events during the first part of this first bean. There was a quite optimistic post in 2014 - https://answers.splunk.com/answers/143069/how-does-partial-true-affects-timechart-results.html. But for me it doesn’t work. The same issue is here - https://answers.splunk.com/answers/432520/why-is-timechart-partialfalse-still-returning-part.html So it would be great to solve that issue. ... View more