Here's one idea: ... | timechart span=1h sum(numErrors) as ErrorCount by serverName This will show one line for each server. Each point on the line will represent one hour of errors. If you want more suggestions, we need a little more information, like - how did you get the three fields? What does the source look like? HTH! ... View more