Align your time period to 6pm for example
earliest=-7d@d-6h
Rather than using timechart, you could split it up into the different steps.
| bin span=12h _time
| stats your metrics by your groups and _time
| xyseries _time group metric
However, this will align to midnight and noon, so make adjustments before and after
| eval _time=relative_time(_time,"-6h")
| bin span=12h _time
| stats your metrics by your groups and _time
| eval _time=relative_time(_time,"+6h")
| xyseries _time group metric
Align your time period to 6pm for example
earliest=-7d@d-6h
Rather than using timechart, you could split it up into the different steps.
| bin span=12h _time
| stats your metrics by your groups and _time
| xyseries _time group metric
However, this will align to midnight and noon, so make adjustments before and after
| eval _time=relative_time(_time,"-6h")
| bin span=12h _time
| stats your metrics by your groups and _time
| eval _time=relative_time(_time,"+6h")
| xyseries _time group metric
That worked wonderfully, thank you. One thing though, for some reason the +-6 adjusted mine to 10am and pm. No worries though, I just made it +-2 and it worked. Probably has to do with time zone. Thanks again