https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376122#M168124 <P>Yea, timechart will increment dynamically or based on the <CODE>span</CODE> attribute in the rendering. But you might have to avoid timechart to avoid the unwanted time periods. Therefore, you're essentially just doing what @akocak described: making a generic chart for which you happen to have the x-axis as time, but Splunk just treats it like an arbitrary value list.</P> Fri, 27 Jul 2018 12:30:55 GMT sloshburch 2018-07-27T12:30:55Z https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376120#M168122 <P>I am trying to create a timechart to count data for 7 days during business hours. I have the search working fine my problem is the user does not want to see business hours on the x-axis.</P> <P>sample<BR /> index=_internal|bucket _time span=1h|where date_hour&gt;=8 and date_hour&lt;16 |timechart count by sourcetype<BR /> <IMG src="https://community.splunk.com/storage/temp/253589-screen-shot-2018-07-26-at-105200-am.png" alt="alt text" /></P> <P>I do not want to make it continuous since the users assume the connection represents real values. Im looking to only show 8am-4pm each day on the x-axis.</P> Tue, 29 Sep 2020 20:39:29 GMT https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376120#M168122 jmerry_splunk 2020-09-29T20:39:29Z https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376121#M168123 <P>it doesn't give you exactly what you need. however, representation wise, I believe this is not too far from what you need:</P> <PRE><CODE>index=_internal | bucket _time span=1h | where date_hour&gt;=8 and date_hour&lt;16 | sort date_mday | eval mhour = date_wday.":".date_hour | chart count over mhour by sourcetype </CODE></PRE> <P>You should also note that, timechart command would have its own span and I am not sure how 1h would work in weekly chart. </P> Thu, 26 Jul 2018 15:44:59 GMT https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376121#M168123 akocak 2018-07-26T15:44:59Z https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376122#M168124 <P>Yea, timechart will increment dynamically or based on the <CODE>span</CODE> attribute in the rendering. But you might have to avoid timechart to avoid the unwanted time periods. Therefore, you're essentially just doing what @akocak described: making a generic chart for which you happen to have the x-axis as time, but Splunk just treats it like an arbitrary value list.</P> Fri, 27 Jul 2018 12:30:55 GMT https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376122#M168124 sloshburch 2018-07-27T12:30:55Z https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376123#M168125 <P>When you say "the user does not want to see business hours", what do you mean?</P> Fri, 27 Jul 2018 14:27:49 GMT https://community.splunk.com/t5/Splunk-Search/Restrict-timechart-to-business-hours/m-p/376123#M168125 DalJeanis 2018-07-27T14:27:49Z