That is interesting because I recreated your inputs and charts (of course with different searches, but also timechart ones) and they seem to be working fine. I noticed however that you posted this on 30.09.2021 but have data from 1.10.2021 already. If you have data from the future, you might hit similar issue as https://community.splunk.com/t5/Splunk-Enterprise/help-on-basic-question-about-span-in-timechart/m-p/569085#M10160
... View more
Something like this? index=ascrm sourcetype=jmx NumUiSessions=* host IN (z1il0095*,z1il0096*,z1il0097*,z1il0098*)
| bin _time span=1h
| stats latest(NumUiSessions) as latest_NumUiSessions by host _time
| streamstats sum(latest_NumUiSessions) AS UISessions by _time
... View more