Hi guys, I'm currently facing an issue. I have csv logs being ingested every 1 min with the status of some services - either "Running" or "Stopped". What I want is to show the trend on timeseries chart. The query I am using is: index="main" host="xyz_hostname" | where(Service_Name="xyz") | sort by Timestamp desc | dedup Timestamp | dedup Service_Status |reverse | table Timestamp, Service_Status | eval Service_Status=if(Service_Status=="Running", 1, Service_Status), Service_Status=if(Service_Status=="Stopped", 0, Service_Status) Timeseries visualization works fine when I select a short time range but when I select a range like "last 30 days", I get "These results may be truncated. This visualization is configured to display a maximum of 10000 results per series, and that limit has been reached" I know I can modify the chart config to accomodate the output put I want to modify my search so that it doesn't takes the points where the status is "Stopped" repeatedly for hours. Inspite if it can only take the timestamp when the status changed from "Running" to "Stopped" or vice-versa. Can someone help me write such search query? ... View more