@azeller If you want timechart to display the count per second irrespective of the bin width timechart calculates internally: | bucket _time span=1m | stats count by _time TYPE | timechart per_second(count) by TYPE The per_unit functions will sum the field values over the timechart bin and then divide by the number of time units within that bin. If you want to fix the bin width at one minute: | bucket _time span=1m | stats count by _time TYPE | timechart span=1m per_second(count) by TYPE However, you will run into chart display limits over large timespans. The chart can display no more x-values than the width of the chart in pixels. Note that timechart's bin option is merely a suggestion. Like the bin/bucket command, it will use at most the number of bins you specify but will likely use less.
... View more