Hi everyone, I am trying to create a timechart showing distribution of accesses in last 24h filtered through stats command. More precisely I am sorting services with low accesses number but higher than 2 and considerating only 4 less accessed services using this: index = |bin _time span=1h | stats count by Service _time | where count>2 | sort 4 count | rename count as "Access number" | timechart span=1h count by Service   Results would show services with number of accesses of 1 or 2 in a day despite the where clause. Thank you in advance for your help. ... View more