https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255466#M76481 <P>See if add <CODE>cont=f</CODE> to the timechart command gives you the desired output.</P> Wed, 31 Aug 2016 15:16:41 GMT sundareshr 2016-08-31T15:16:41Z https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255465#M76480 <P>Given a search:</P> <PRE><CODE>index="muni" | nbclosest | timechart span=30m dc(vehicle_id) as NumVehicles </CODE></PRE> <P>(where <CODE>nbclosest</CODE> is a custom search command that filters results and isn't relevant to this question) it correctly charts the data, but the problem the data is only from a subset of hours in the day, e.g., 10am to 7pm. When plotting it, it looks like the attached image:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1783i6AE38C55A6F4F174/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I'd like to change the chart so that the times outside 10am-7pm aren't displayed at all. It would be as if the chart were squished horizontally by removing midnight-10am and 7pm-midnight.</P> <P>How can I do this?</P> Wed, 31 Aug 2016 15:09:58 GMT https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255465#M76480 plucas_splunk 2016-08-31T15:09:58Z https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255466#M76481 <P>See if add <CODE>cont=f</CODE> to the timechart command gives you the desired output.</P> Wed, 31 Aug 2016 15:16:41 GMT https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255466#M76481 sundareshr 2016-08-31T15:16:41Z https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255467#M76482 <P>Give this a try. You may loose the x-axis markers</P> <PRE><CODE>index="muni" | nbclosest | bucket span=30m _time | stats dc(vehicle_id) as NumVehicles by _time </CODE></PRE> Wed, 31 Aug 2016 15:56:07 GMT https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255467#M76482 somesoni2 2016-08-31T15:56:07Z https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255468#M76483 <P>This produces the same result as adding <CODE>cont=f</CODE> but, oddly, says "0 events" on the left.</P> Wed, 31 Aug 2016 17:38:27 GMT https://community.splunk.com/t5/Splunk-Search/Getting-rid-of-unused-time-in-timechart/m-p/255468#M76483 plucas_splunk 2016-08-31T17:38:27Z