Create Time Chart With One-Minute Intervals

Analyze request methods in fixed one-minute buckets using the timeChart() function

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} result{{Result Set}} repo --> 1 1 --> result

logscale

timeChart(span=1min, series=method, function=count())

Introduction

The timeChart() function can be used to create time-based visualizations by grouping events into fixed time intervals specified using the span parameter.

In this example, the timeChart() function is used with the span parameter to create a time series visualization showing the count of HTTP request methods aggregated into one-minute intervals.

Example incoming data might look like this:

@timestamp	method	path	status_code	response_time
2025-08-06T10:00:15Z	GET	/api/users	200	45
2025-08-06T10:00:45Z	POST	/api/users	201	78
2025-08-06T10:01:12Z	GET	/api/products	200	32
2025-08-06T10:01:38Z	PUT	/api/users/1	200	65
2025-08-06T10:02:05Z	DELETE	/api/users/2	204	28
2025-08-06T10:02:30Z	GET	/api/orders	200	52
2025-08-06T10:03:18Z	POST	/api/orders	201	89
2025-08-06T10:03:42Z	GET	/api/products	200	41
2025-08-06T10:04:15Z	PUT	/api/orders/1	200	67
2025-08-06T10:04:55Z	GET	/api/users	200	38

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} result{{Result Set}} repo --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
timeChart(span=1min, series=method, function=count())
```
Creates a time series chart by grouping events into fixed one-minute intervals using span=1min
The series parameter groups the data by the method field, creating separate lines for each unique HTTP method.
The function parameter uses count() to calculate the number of events in each minute interval for each method.
The span parameter creates fixed-width time buckets, ensuring consistent interval sizes regardless of the query time range. This differs from using buckets, which divides the total time range into a specified number of intervals. For an example, see Create Time Chart With Fixed Bucket Count.
Event Result set.

Summary and Results

The query is used to analyze the precise per-minute distribution of HTTP request methods, providing fixed time interval analysis.

This query is useful, for example, to monitor minute-by-minute API usage patterns, detect short-term spikes in specific request methods and analyze request patterns with consistent time granularity

If you want to create a time series visualization showing the distribution of HTTP methods within the HUMIO repository, you can use this query:#kind=requests | timeChart(span=1min, series=method, function=count())

Sample time chart from the incoming example data will look like this:

Showing Time Chart With One-Minute Intervals

Note that events are grouped into the minute they occurred in, regardless of the specific seconds.

Examples Library