How to count over time all logs over last 10 business days during business hours?

I want to count_over_time logs matching an expression over the last 10 business days only between 10:00 and 17:00 hours. At best, would be if the count would split for every 1 hour.

I am executing the roughly following, not real code::

for daysago in range(20):
   query = """
                   sum by (job) (count_over_time(
                        {source="%s", job=~"%s"}
                       | job !~ ".*TEST.*"
                        | job !~ ".*\\..*"
                        |= ": [GC ("
   """ % (source, job)
   result = query_range(
      end=datetime.datetime.combine( - datetime.timedelta(days=daysago), datetime.time(17)),

As I understand, “end” is the ending time, i.e. 17:00 on a particular day and “since” should be set to 7 hours.

The api requests look like the following:


However, the resulting value is extremely big. I do not understand where is it coming from, however from my experiments it looks to be related to “step” of the API, as-if loki has calculated [1h] range over multiple ranges and summed up. Setting step to 1 hour, results in no results - the api response is empty array.

How do I get count_over_time split for every hour over specific range of dates? Thanks.

Couple of changes I’d try:

  1. Change your API endpoint to instance query (/query) instead of query_range.
  2. Change the interval in your query to [7h] instead of [1h] (might even make that a variable).
  3. Because you are now using instance query, you’d want to use the time at the end of the day so [7h] includes the past 7 hours according to query time.