Hi @ITWhisperer, thank you for your anwser! I've tested different syntaxes, different comands, research comands at "Splunk Search Reference" and changed fields... The search now creates the desired time- list but doesn't fill the gaps. index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | makecontinuous span=10s _time | filldown action index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | makecontinuous span=10s _time | filldown action | chart list(action) OVER _time index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | chart list(action) OVER _time | makecontinuous span=10s _time | filldown action index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | chart list(action) OVER _time | makecontinuous span=10s action index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | chart list(action) OVER _time | makecontinuous span=10s _time index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | timechart list(action) | makecontinuous span=10s _time index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | timechart list(action) | makecontinuous span=10s _time | filldown action The results always looks like following or similar: Kind regards, Felix
... View more