I think you missed the point. timechart span=1m creates _time for each minute whereas bin _time span=1m only has _time for events which exist. timechart can be useful to see for instance the minutes where expected events didn't occur but should have. Identifying minutes where count=0 is easily accomplished with timechart but with a by the untable is needed to allow where count=0. In any case, the suggestion to use untable then use the where statement with timechart/by solved my problem and why I gave Karma. How do you search results produced from a timechart with a by? Use untable!
... View more