https://community.splunk.com/t5/Splunk-Search/Timechart-query-for-Splunk-Visualization-42/m-p/445762#M195839 <P>Need help with the following code:<BR /> index=corp_security_tanium splunk_server=phx11* sourcetype=ABC <BR /> | eval time=strptime(Last_Found_Date,"%Y-%m-%d") <BR /> | eval _time=time <BR /> | bucket span=w@w1 _time<BR /> | stats values(ABC) by ABC _time<BR /> | timechart span=w@w1 count(ABC) as "Accumulated count"</P> <P>Time filter : Last 7 days<BR /> basically it should show the current no. and what the difference between last week and today</P> <P>Thanks</P> Wed, 30 Sep 2020 00:24:43 GMT smthakur73 2020-09-30T00:24:43Z https://community.splunk.com/t5/Splunk-Search/Timechart-query-for-Splunk-Visualization-42/m-p/445762#M195839 <P>Need help with the following code:<BR /> index=corp_security_tanium splunk_server=phx11* sourcetype=ABC <BR /> | eval time=strptime(Last_Found_Date,"%Y-%m-%d") <BR /> | eval _time=time <BR /> | bucket span=w@w1 _time<BR /> | stats values(ABC) by ABC _time<BR /> | timechart span=w@w1 count(ABC) as "Accumulated count"</P> <P>Time filter : Last 7 days<BR /> basically it should show the current no. and what the difference between last week and today</P> <P>Thanks</P> Wed, 30 Sep 2020 00:24:43 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-query-for-Splunk-Visualization-42/m-p/445762#M195839 smthakur73 2020-09-30T00:24:43Z