Good day
The following problem: I load data into Splunk once a week. However, not always on the same day.
I now want to show a trend to last week on a dashboard, but the span option must fit to the day. Is there a way that the span option automatically adjusts to the next date where there is data?
Or do you have another suggestion how I can solve the problem?
Currently, if the span does not fit exactly, I have an increase of 100%.
My current search query is very basic:
index=test CVSS_v3_Severity=$severity_tok$ Operating_System_Generation=$os_dd_tok$ | dedup CVE | timechart span=7d count
Thanks in advance and best regards
Nico
It is not clear why span=7d is not working for you. Please can you provide example events which demonstrate the issue (anonymised of course)?