Is there is a way to collect this data in a more efficient way?

[JLopez]

Hi Splunk friends,

I'm using windows data for this example. 

I want to collect in a time range of last 7 days, the numbers of hosts from my windows index with a span of 1d

the result I am expecting is that every day I can see in a timechart the total numbers of host on each day increases of decreases

to do that I am using this search
index=<windows Index>    Computer=XYZ* | dedup Computer | timechart count(Computer) as count span=1d

The problem I am having is that the search never ends so only show a flat line and a peak from the last day. 
I have around1000 host. 

is there is a way to collect this data in a more efficient way? 

Thank in advance.

[JLopez]

Thanks @scelikok 

it worked like a charm.

[scelikok · Accepted solution]

Hi @JLopez,

You can use below query;

| tstats dc(host) as count where index=<windows_index> host=XYZ* earliest=-7d by _time span=1d