I have done 2 (what I thought were) identical searches.
One ended with:
| timechart first(valueA) as A first(valueB) as B
The other ended with:
| chart first(valueA) as A first(valueB) as B by _time
Why do they produce two different results?
The first one gives me 6 results for valueB where as the second gives me 3 results for valueB over the same 60 day time period.
Thank you in advance.
timechart
buckets your results (automatically if you don't override the default) into chunks of time, whereas chart... by _time
discretizes your results so that the buckets represent a group of events where each one has the exact same timestamp.
For example, let's say you were charting ten events over a five-day period:
Day 1 1:00 - B=5
Day 1 2:00 - B=7
Day 2 1:00 - B=5
Day 2 2:00 - B=7
Day 3 1:00 - B=5
Day 3 1:00 - B=7
Day 4 1:00 - B=5
Day 4 2:00 - B=7
Day 5 1:00 - B=5
Day 5 2:00 - B=7
Notice on Day 3, the two events happen at the same time.
In the timechart
case, it would break this up into five days by default, and give me the first B in each one, so you'd end up with five results, one for each day, each with B=5. In the chart... by _time
case, though, since there are nine different values of _time
across the ten events, you would get nine results, two each for all the days except Day 3, and one for Day 3.
Hope that helps!
timechart
buckets your results (automatically if you don't override the default) into chunks of time, whereas chart... by _time
discretizes your results so that the buckets represent a group of events where each one has the exact same timestamp.
For example, let's say you were charting ten events over a five-day period:
Day 1 1:00 - B=5
Day 1 2:00 - B=7
Day 2 1:00 - B=5
Day 2 2:00 - B=7
Day 3 1:00 - B=5
Day 3 1:00 - B=7
Day 4 1:00 - B=5
Day 4 2:00 - B=7
Day 5 1:00 - B=5
Day 5 2:00 - B=7
Notice on Day 3, the two events happen at the same time.
In the timechart
case, it would break this up into five days by default, and give me the first B in each one, so you'd end up with five results, one for each day, each with B=5. In the chart... by _time
case, though, since there are nine different values of _time
across the ten events, you would get nine results, two each for all the days except Day 3, and one for Day 3.
Hope that helps!