I'm using timechat to count the number of events per minute in a single value display: search | timechart span=1m count
This works fine. However, each time span is aligned to the top of the minute, meaning that the single value is only ever accurate when the search is conducted at the top of the minute. I want my single value to display the total number of requests in the last minute from now and not the last whole minute.
For example, if the search is running at 12:15:39, the single value should show the count of events between 12:14:39 and 12:15:39, rather than the count from 12:14:00 to 12:15:00 (or, if using partial=true , 12:15:00 to 12:15:39)
Is timechart suitable for this or do I need to use another method?
... View more