I try make nice timechart how many objects are unavailable in specific time. In my log I have start and end events from every outages and they are binded nicely together. Also I have calculated how long these outages are (in minute accuracy). When I try to drad timechart with : index=alarms event=add OR event=clear | transaction event_id startswith=(event=add) endswith=(event =="Clear") keepevicted=true | timechart dc(event_id) I've got line stay up whole day. If I add span=15min (the accuracy what I want), I got only small spikes(15min), even those outages are 4 or 5 hours long. Analog: Restaurant have log on every seat when customer sit down and stands up. Every customer uses different time when they are eating. I want know how many customer we have in specific 15min timewindow in graph. ... View more