Thank you so much @ITWhisperer , It helped. ... View more

yeah, I have tried the path. I could not able to get to the part of considering having the events for weekday if they have in other.   index=** | timechart count(_raw) as events span=1m | eval Time=strftime(_time,"%A %T") | stats count by Time events ... View more

I got till the point of getting down to find the gap, but not quite getting to boil down to grouping weekdays and merging same weekday events to one to replace the time range which don't have events with one which have.   index=* | timechart count(_raw) as events span=1m | eval Availability=if(events=1,"1","0") | streamstats count(eval(Availability=1)) as unique_count | delta _time as Duration | search Availability=0 | stats earliest(_time) as From sum(Duration) as Duration by Availability unique_count | eval Duration1=Duration-60 | eval To=strftime(From+Duration1,"%c"), From=strftime(From,"%c") | where Duration>300 | fields Availability From To Duration  ... View more

Sunday Feb 1 - events at 10:00,10:04,11:00 Monday Feb 2nd - events at 9:00,9:01,9:04 Tuesday Feb 3rd - events 0 ' ' ' ' ' Sunday Feb 8- events at 9:00, 12:00 Monday Feb 9 - 0 events Tuesday Feb 10 - events at 7:00 so in the given search span (time range can be anything, maybe 30 days, 90days etc), my search should least bother about the date. main concern is weekday and Time data unavailability reporting  results expected Sunday at 0 through sunday at 8:59 [539 minutes] Sunday at 9:01 through sunday at 9:59 [duration b/w 9:01 to 9:59 minutes] Sunday at 10:01 through sunday at 10:03 Sunday at 10:05 through sunday at 10:59 Sunday at 11:01 through sunday at 11:59 Sunday at 12:01 through Monday at 08:59 Monday at 09:02 through Monday at 09:03 Monday at 09:05 through Tuesday at 06:59 ... View more