https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388089#M113174 <P>Hi @muralianup,</P> <P>Did this work for you?</P> Mon, 25 Jun 2018 13:20:35 GMT renjith_nair 2018-06-25T13:20:35Z https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388087#M113172 <P>I need help with time chat query. Basically I want to display all the graph occurrences where the count hit 0 and stayed like that. </P> <P>base search | timechart count by URL limit=100 </P> <P>That's where I am and there are some URL hits which were active at certain time then count was 0. I am searching through more than 1 URL and only want those whose count was zero after specific time.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5209i5ECC82DBC3CE8D40/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 19 Jun 2018 16:00:06 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388087#M113172 muralianup 2018-06-19T16:00:06Z https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388088#M113173 <P>Hi @muralianup,</P> <P>Try this</P> <PRE><CODE>base search | timechart count by URL limit=100|untable _time URL count|where (count = 0 AND _time&lt;your_time_filter) </CODE></PRE> Wed, 20 Jun 2018 13:18:53 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388088#M113173 renjith_nair 2018-06-20T13:18:53Z https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388089#M113174 <P>Hi @muralianup,</P> <P>Did this work for you?</P> Mon, 25 Jun 2018 13:20:35 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-to-filter-inactive-buckets/m-p/388089#M113174 renjith_nair 2018-06-25T13:20:35Z