I have a query in which I use bucket to remove some duplicates at certain intervals. I am now trying to timechart this data but I would like to use the buckets I already created rather than using the span or bins option on timechart.
When not specifying a span or bins option timechart defaults and combines the buckets split by the bucket command. Eg.
If I specify a span in the timechart command it seems to work better, however, I am not convinced timechart is not still combining buckets.
What are my options here?
As an example I have log entries that look like this.
What I am looking for is a timechart that shows the distinct count of fieldB for each value of fieldA in each bucket. So assuming all the entries above are in one bucket the value for server1 is 2 and for server2 is 2.
Well I think if you're doing the bucketing by hand with the bucket command, you might as well go all the way and just use
The end result is the same, but when you use stats instead of timechart you'll be sure that really isnt any more bucketing going on.
1) to get the "timechart showing the distinct count of field A for each value of field B", you'd just do
2) And the flash chart doesn't care whether the rows and columns come from