Something I would like to add to the answer of alextanght is that the command "date_...." is not consistent in most cases. It really depends on how splunk gets the timestamp from the data base you are using. It is best practice to use the "strftime" command to get the timestamp. So the query becomes as following sourcetype=”purchase” | eval time_hour = strftime(_time, "%H") | eval time_day = strftime(_time, "%D") | stats count(customer_id) AS hit BY time_hour, time_day | chart avg(hit) By time_hour cheers,just a comment: date_hour and it's variations do not work well. It's more consistent to define for instance the hours of the day using: eval time_hour = strftime(_time, "%H"). You can do something similar for years,days,month,..... So the query will become as follows sourcetype=”purchase” | eval time_hour = strftime(_time, "%H") | eval time_day = strftime(_time, "%D") | stats count(customer_id) AS hit BY time_hour, time_day | chart avg(hit) By time_hour ... View more