Why would a bucket/bin be set to a one day span on the License Master?

[pkeller]

Looking at the Daily License Usage panel on the "Previous 30 Days" tab under Licensing, I see that the base search is:

index=_internal [set_local_host] source=license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time
| stats sum(b) AS volumeB max(stacksz) AS stacksz by _time
| eval pctused=round(volumeB/stacksz*100,2)
| timechart span=1d max(pctused) AS "% used" fixedrange=false

What is the idea behind setting _time 1/2 day behind?

Thank you.

[somesoni2 · Accepted solution]

The rollover summary is (and can be) generated after the whole day is passed. It's just an adjustment to ensure correct rollover summary is selected for that day (summary generated today will be for yesterday).