Try this - host="[redacted]" src_port=* | bucket _time span=1h | stats count as mycount by _time | appendpipe [| stats min(_time) as mintime max(_time) as maxtime | eval maxtime=maxtime+1 | eval mytime=mvrange(mintime, maxtime,3600) | mvexpand mytime | eval _time=mytime | eval mycount=0 | table _time mycount ] | stats sum(mycount) as mycount by _time | eval _time=strftime(_time, "%Y-%m-%d %H:%M") ... View more