https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241758#M71918 <P>Try something like this</P> <P>If date_hour is available in your data</P> <PRE><CODE>your search date_hour&gt;=9 AND date_hour&lt;17 | your timechart command </CODE></PRE> <P>If date_hour is not present,</P> <PRE><CODE>your search | eval date_hour=strftime(_time,"%H") | where date_hour&gt;=9 AND date_hour&lt;17 | your timechart command </CODE></PRE> Mon, 14 Mar 2016 18:30:14 GMT somesoni2 2016-03-14T18:30:14Z https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241757#M71917 <P>I would like to timechart only events that happened between 9 AM and 5 PM...any help would be appreciated</P> Mon, 14 Mar 2016 18:21:19 GMT https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241757#M71917 peter_gianusso 2016-03-14T18:21:19Z https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241758#M71918 <P>Try something like this</P> <P>If date_hour is available in your data</P> <PRE><CODE>your search date_hour&gt;=9 AND date_hour&lt;17 | your timechart command </CODE></PRE> <P>If date_hour is not present,</P> <PRE><CODE>your search | eval date_hour=strftime(_time,"%H") | where date_hour&gt;=9 AND date_hour&lt;17 | your timechart command </CODE></PRE> Mon, 14 Mar 2016 18:30:14 GMT https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241758#M71918 somesoni2 2016-03-14T18:30:14Z https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241759#M71919 <P>Hi, </P> <P>You need a where clause using date_hour, and then you'll probably want to increase the bins, or use the bucket command to help show time periods when there isnt data:</P> <PRE><CODE> index=_internal | where date_hour&gt;=9 AND date_hour&lt;=17 | timechart count bins=1000 </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1120iE8D9EA1573141014/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 14 Mar 2016 18:30:39 GMT https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241759#M71919 jkat54 2016-03-14T18:30:39Z https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241760#M71920 <P>if i hadnt taken the screenshot... ;-P, you beat me to it by 25s!</P> Mon, 14 Mar 2016 18:31:48 GMT https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241760#M71920 jkat54 2016-03-14T18:31:48Z https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241761#M71921 <P>thank you!!</P> Mon, 14 Mar 2016 18:50:12 GMT https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241761#M71921 peter_gianusso 2016-03-14T18:50:12Z https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241762#M71922 <P>thank you!!</P> Mon, 14 Mar 2016 18:50:24 GMT https://community.splunk.com/t5/Splunk-Search/timechart-only-business-hours/m-p/241762#M71922 peter_gianusso 2016-03-14T18:50:24Z