Problems with timechart

[responsys_cm]

I have a saved search that runs every hour and saves a count of events into a summary index. A chart on a dashboard displays that data as follows:

index=si-security search_name="SI: Bit9 - Count of Execution Blocks (1 Hour)" | timechart count by signature bins=168

The chart is over a 7 day period. I would like the resolution of the chart to show events by hour. Whether I use bins=168 or span=7d, the chart is displaying the sum of the hourly count on a daily basis.

What am I doing wrong here?

Thx.

Craig

[Ayn · Accepted solution]

If you want timechart to operate on a by-hour basis, you should set span=1h.

index=si-security search_name="SI: Bit9 - Count of Execution Blocks (1 Hour)" | timechart span=1h count by signature