I have this real-time query with a 12 week back fill: host="<some host>" OR host="<some other host>" "<some search text to key on>" [ | stats count | eval date_hour=strftime(now(),"%H") | eval date_wday = lower(strftime(now(),"%A")) | fields - count ] | bucket _time span=1h | stats count by _time What is happening is every day this query will not return any results after 23:59 and before 10:00 AM. As soon as the time rolls over to 10:00 I can refresh and the search will have the expected results and works correctly for the remainder of the day until midnight. It seems that there is an issue with strftime(now(),"%H") when the time starts with a 0. I tried changing the %H to %k and %I but neither helps the search work properly before 10 AM. I can manually type in the hour into the query and get the correct result but using the function the query returns no results. Does anyone have any thoughts on what I might be doing wrong here? Thanks! ... View more