After multiple and repeated attempts, the query was unable to return data like the week starting from today, hence i had to go the span of 1w@w1, where the weeks starts from Monday and ends in Sunday. The problem with this approach is the return of additional days data (>30) even when the earliest is set to last 29 days from today. The following is the query, index="83299-aci" sourcetype="_internal" earliest=-29d@w1 latest=+1d@d-1s | timechart span=1w@w1 sum(auditsCount) as "count" |eval timeTp=strftime(_time,"%Y-%m-%dT%H:%M:%S%:z") | eval today=relative_time(now(), "@d")|eval yesterday=relative_time(now(), "+1d@d-1s")|eval yesterday = strftime(yesterday,"%Y-%m-%dT%H:%M:%S%:z")| eval weekend=_time+604799 | eval currentWeekend=today-518400 |eval currentWeekend = strftime(currentWeekend,"%Y-%m-%dT%H:%M:%S%:z")|eval weekend=strftime(weekend,"%Y-%m-%dT%H:%M:%S%:z")| eval minTime =min(_time)| eval diff = (today - minTime)| eval diff = round(diff/60/60/24) | eval minTime = strftime(minTime,"%Y-%m-%dT%H:%M:%S%:z") | eval _time = strftime(_time,"%Y-%m-%dT%H:%M:%S%:z")|eval dayBefore =(today-1)|eval dayBefore=strftime(dayBefore,"%Y-%m-%dT%H:%M:%S%:z") | eval tonight =(today+(86400-1))|eval tonight=strftime(tonight,"%Y-%m-%dT%H:%M:%S%:z")| eval today = strftime(today,"%Y-%m-%dT%H:%M:%S%:z")| eval week = case((diff=0),today+" - "+tonight,(diff <= 7),_time+" - "+tonight,(diff > 7) ,_time+" - "+weekend) | eval count = if(count!="" or count != NULL, count,0 ) | table week count Thank you for your support @DMohn Regards Mohammed Shahid Nawaz ... View more