Takajian
Thanks! that helped
I think timechart command does not support what you want. In stead, do you think stats command work?
" * | strcat clientip "@" uri A_COMBO | stats count by A_COMBO _time | search count > 20"
Then, you will be able to use timechart if you want.