Hello, I am charting IT help desk tickets and I need to make a chart showing how many tickets are opened and closed every month. The timestamp for _time is the ticket failure_date. To accurately reflect how many tickets are closed per month I need to search "All_Time" so if a ticket were opened in say December 2016 and then closed in March 2017 it'll be captured in the graph. Now I can get all the data to graph but I would like to only graph select months if possible. Below is the current search I am using: sourcetype=Current_file | where STATUS != "DRAFT" | eval FAILURE_DATE=strptime(FAILURE_DATE, "%m/%d/%Y %H:%M") | eval CLOSED_DATE=strptime(CLOSED_DATE, "%m/%d/%Y %H:%M") | eval STATUS=mvappend("Open","Closed") | mvexpand STATUS | eval _time=case(STATUS="Open", FAILURE_DATE, STATUS="Closed", CLOSED_DATE) | timechart span=1mon count by STATUS ... View more