Exactly what time:start_time do?

[deni]

Hi,

I have the following two queries and wondering what is the difference:

fetch spans
| makeTimeseries sum(duration)

fetch spans
| makeTimeseries sum(duration), time:start_time

I tried both in Playground, but I can’t see any difference. I also thought about using a join command to compare the responses, but I don’t see which column I could use for the join. According to the documentation:

time	

expression
	
The expression that provides the timestamp for a record, which will be assigned to a series bucket. If the current data does not contain a field timestamp the parameter needs to be specified, referencing the time field. The default value is timestamp. If the timestamp field doesn't exist, the second default value is start_time.

 e.g. the parameter needs to be specified if there is no column timestamp.

In the case of the spans, I don't see timestamp column, but it seem that the query still works without specifying time:start_time.

This questions comes from the DQL course in the university, this is the exact task:

Evaluating Data over time

The operations team is starting to suspect some of these are being caused by long request times. Modify the below query to display maximum duration of spans over time.

HINT: use the time:start_time argument to set which timestamp is used for the timeseries.

The query from which we have to start is:

fetch spans

Thanks!

Regards, Deni

[krzysztof_hoja]

It looks like documentation unclear. IMHO it should sound like :

If the current data does not contain a field timestamp or field start_time the parameter needs to be specified

now it is explained in additional sentence:

If the timestamp field doesn't exist, the second default value is start_time.

[deni]

I suppose this means the HINT is also not correct? For example, as I suspected, the result is the same with or without time:start_time (since when timestamp is missing, the default becomes start_time).

I assume this parameter is only useful in cases where both timestamp and start_time exist. Do you maybe have an example of such a case?