Hi Splunk friends,
I'm using windows data for this example.
I want to collect in a time range of last 7 days, the numbers of hosts from my windows index with a span of 1d
the result I am expecting is that every day I can see in a timechart the total numbers of host on each day increases of decreases
to do that I am using this search
index=<windows Index> Computer=XYZ* | dedup Computer | timechart count(Computer) as count span=1d
The problem I am having is that the search never ends so only show a flat line and a peak from the last day.
I have around1000 host.
is there is a way to collect this data in a more efficient way?
Thank in advance.