I am trying to build a trending dashboard of the count of tickets we get. With the below query, I am trying to display the increase/decrease in the count of tickets we got for each type for the past two weeks.   index=tickets Status IN ("Open", "Pending") earliest=-14D@w0 latest=@w0 | dedup ticketid | eval ticket_type=case(like(Tags,"%tag1%"),"Type1", like(Tags,"%tag2%") AND !like(Tags,"%tag1%"), "Type2", like(Tags,"%tag3%") AND !like(Tags,"%tag1%") AND !like(Tags,"%tag2%") , "Type3") | timechart usenull=f span=1w count by ticket_type   The problem is whenever we have more count(tickets) for the previous week, it shows the data with a "-" minus sign.  Question: 1. Not able to understand why a "-" would be there for a count.   2. Is there a way to suppress the "-" sign ? ... View more