How can I group timechart data by day if the day starts at 10 p.m. and ends 10 p.m. the next day?

[sk8asd123]

I'm currently running this search

<data> | timechart span=24h count by day

This gives me from midnight to midnight, but I need 10 p.m. to 10 p.m. to capture a 'work day'

[martin_mueller · Accepted solution]

Assuming "today" starts two hours earlier rather than 22 hours later, you could do this:

<data> | eval _time = relative_time(_time, "+2h") | timechart span=1d count

Basically shifts your day by two hours.