i see what you’re saying.
You could use the map command
| eval now = now()
| eval lastFourHours = now - (4 * 3600)
| eval yesterdayStart = lastFourHours - 86400
| eval yesterdayEnd = now - 86400
| map search=[| tstats summariesonly=true count from rc-stats WHERE (_time >= $yesterdayStart$) AND (_time <= $yesterdayEnd$)]
... View more