An old thread, but Splunk has now a better way to do this, using Timewrap https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap Try this: index=_internal sourcetype=splunkd eps>0 earliest=-1mon latest=now | timechart avg(eps) span=1h | timewrap 1w ... View more