Hi guys, i need some help. I'm trying to make a time chart to compare how many times my system gets restarted comparing today with 7 days ago. I have this healthcheck log and the first log is when the user logs in for the first time and the next is the times that the user restarts my app. with the following query works just fine the problem here is that i get the results from (initialization + restart) but i want the result just from the restart.   index=myIndex Title=Healthcheck earliest=-10d@d latest=@d | timechart span=1h count | timewrap d series=short | fields _time s0 s7 | rename s0 as Today, s7 as "7 days ago"   with this other query i have exactly the restart from each user but i cant make it work with time chart.   index=myIndex Title=Healthcheck | stats count by Data.Ip | eval count = count - 1   if it was confused i posted this other question explaining my scenario: https://community.splunk.com/t5/Splunk-Search/How-to-change-the-result-of-my-stats-count/td-p/600364 ... View more