I'm trying to create a visualization of web service activity. I thought the timeline would be a good representation of when services are up and down. Unfortunately, the logs I have to work with ping services every 15 minutes. So every 15 minutes, there's a log that states: <serviceName> is up: true OR <serviceName> is up:false I was able to implement this query and get something back (last 60 minutes): index=application_activity up | transaction startswith="*true" endswith="*false" by service | table _time service duration But of course because of the 15 minute time interval, it has huge gaps. How can I have these gaps filled in as long it as true the service is up, and only have gaps show when it is false? I'm also open to another recommendation for a visualization. ... View more