Answer from martin_mueller: "If your summary index contains a count field, replace | timechart count with | timechart sum(count) as count - else it'll always count events instead of using the pre-aggregated value." ... View more