Each day of the trend chart should show me the total for the last 7 days. For eg:
Apr 7 - sum(Apr 1 - Apr 7)
Apr 8 - sum(Apr 2 - Apr 😎
Apr 9 - sum(Apr 3 - Apr 9)
etc...
This presents a daily improvement for the last 7 days of data set.
Use timewrap.. You gotta pipe in a timechart to do it like this
index=..
| timechart span=1h sum(field_name)
| timewrap 1d
check out the timewrap function - https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Timewrap