If you perform a query that returns events that do not hit the left or right "edge" of your specified time range, and then timechart these events, the timechart axis starts and ends with the first and last event rather than the earliest/latest clause you specified in your query. I would expect the timechart scale to "honor" the query time range. It is an infuriating problem for those who want multiple timecharts on a dashboard as the scale on the various charts may not tally. To illustrate, here is a rather contrived example you can run yourself The below simulates a query over the last day in which all returned events fell within the middle 12h of that day - i.e. nothing during the first/last 4h index=_audit earliest=-1d latest=now | where _time<(now()-60*60*4) AND _time>(now()-60*60*20) | timechart span=5m count Notice that the timechart's x axis starts and ends with the first/last datapoint - in other words it only shows the "populated" 12h rather than the whole 24h. Now for the inelegant workaround. It appears that timechart suddenly DOES honor your timerange if you put a reporting command BEFORE the timechart, for example index=_audit earliest=-1d latest=now | where _time<(now()-60*60*4) AND _time>(now()-60*60*20) | bucket span=5m _time | stats count BY _time | timechart span=5m avg(count) I currently use this as a workaround, but it is artificial and confusing for maintainers. Anyone know of a more elegant fix? ... View more