Hai, please I wanna ask how to accelerate to get timechart with datamodel from this query   | datamodel Intrusion_Detection IDS_Attacks search | search ("IDS_Attacks.src"="10.0.0.0/8" OR "IDS_Attacks.src"="172.16.0.0/12" OR "IDS_Attacks.src"="192.168.0.0/16") AND ("IDS_Attacks.severity"="high" OR "IDS_Attacks.severity"="critical") | table _time,IDS_Attacks.category | timechart useother=`useother` count by IDS_Attacks.category   I have tried to use tstats but the data is not suitable because with tstats command there are some count data which are calculated to be just 1 event in so that timechart not clear, this tstats command I used before   | tstats allow_old_summaries=t count from datamodel=Intrusion_Detection.IDS_Attacks where ("IDS_Attacks.src"="10.0.0.0/8" OR "IDS_Attacks.src"="172.16.0.0/12" OR "IDS_Attacks.src"="192.168.0.0/16") AND ("IDS_Attacks.severity"="high" OR "IDS_Attacks.severity"="critical") by _time span=s IDS_Attacks.category | timechart useother=`useother` count by IDS_Attacks.category   thanks for your help before best regard ... View more