You can eval time into the day of week: | eval dayOfWeek=strftime(_time, "%A") This will mean dayOfWeek will be, Monday, Tuesday... You could then say something like where dayOfWeek != "Saturday". ... View more

sprry for not providing more information before! Actually I just added the time into the messages and extracted them using regex. after doing a sort tks! ... View more

I reached out the result I wanted by using join type=left ... View more

Thanks @niketn but I tried another way and it worked fine! <colorPalette type="expression">case (value =="-", "", value &gt; "00:15:00","#D3828C", value &lt;= "00:05:00" ,"#C8E8C6", value &gt; "00:05:00" and value &lt;= "00:15:00","#F2B094"</colorPalette> ... View more