Restrict timechart to business hours

[jmerry_splunk]

I am trying to create a timechart to count data for 7 days during business hours. I have the search working fine my problem is the user does not want to see business hours on the x-axis.

sample
index=_internal|bucket _time span=1h|where date_hour>=8 and date_hour<16 |timechart count by sourcetype

I do not want to make it continuous since the users assume the connection represents real values. Im looking to only show 8am-4pm each day on the x-axis.

[DalJeanis]

When you say "the user does not want to see business hours", what do you mean?

[akocak]

it doesn't give you exactly what you need. however, representation wise, I believe this is not too far from what you need:

index=_internal 
| bucket _time span=1h 
| where date_hour>=8 and date_hour<16 
| sort date_mday
| eval mhour = date_wday.":".date_hour
| chart count over mhour by sourcetype

You should also note that, timechart command would have its own span and I am not sure how 1h would work in weekly chart.

[sloshburch]

Yea, timechart will increment dynamically or based on the span attribute in the rendering. But you might have to avoid timechart to avoid the unwanted time periods. Therefore, you're essentially just doing what @akocak described: making a generic chart for which you happen to have the x-axis as time, but Splunk just treats it like an arbitrary value list.