https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671811#M55000 <P>thanks, it helped .&nbsp;</P> Wed, 13 Dec 2023 22:41:10 GMT prasant 2023-12-13T22:41:10Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671193#M54943 <P>How to display timechart for specific time period for specific business days.</P><P>Eg: index="someindex" |dedup eventid| timechart count(_raw) by eventName span=60m for monday,tuesday, wednesday, thursday, friday during 6pm - 8pm.&nbsp; Or for specific dates .How can achieve this?&nbsp;<BR /><BR />thanks in advance</P> Thu, 07 Dec 2023 21:23:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671193#M54943 prasant 2023-12-07T21:23:22Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671203#M54947 <P>You can do this if you have the date_wday field in your data</P><LI-CODE lang="markup">index="someindex" date_wday IN ("monday","tuesday","wednesday","thursday","friday") date_hour&gt;=18 date_hour&lt;20 | dedup eventid | timechart count(_raw) by eventName span=60m </LI-CODE><P>If you don't have those fields you can do</P><LI-CODE lang="markup">index="someindex" | eval date_wday=strftime(_time, "%a") | eval date_hour=strftime(_time, "%H") | search date_wday IN ("mon","tue","wed","thu","fri") date_hour&gt;=18 date_hour&lt;20 | dedup eventid | timechart count(_raw) by eventName span=60m </LI-CODE> Fri, 08 Dec 2023 00:02:42 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671203#M54947 bowesmana 2023-12-08T00:02:42Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671811#M55000 <P>thanks, it helped .&nbsp;</P> Wed, 13 Dec 2023 22:41:10 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-timechart/m-p/671811#M55000 prasant 2023-12-13T22:41:10Z