Hey @zeroCalm  One of the reason why the results are coming for count and not for timechart is because the timechart must not be pointing to correct field for _time. You can override it by converting your time field to splunk time format and pass to _time. Ex: eval formatted_time =strptime(you_time_field_value,"%Y-%m-%dT%H:%M:%S") | eval _time = formatted_time   Posting it as it might help others 🙂 ... View more