So, our application logs duration times of logged method calls as ..dT=XXXms.. and I would like to use this for nice splunk graphs. This works brilliantly if I use a query like this (in advanced charting view) eventtype="app" dT | timechart avg(dT) My Problem is, that the application rarely logs absurdly high duration times going up to several years - clearly a bug of the logging framework we are using. These high dT values sadly totally screw up my nice timechart graphs, and mess with statistics. How can I filter out these values? I already tried filtering those log statements using a where clause, but so far this has not worked for me - result set stays empty. eventtype="app" dT | where dT<3600000 | timechart avg(dT) Any ideas would be much appreciated! ... View more