Timechart trend - for the last 7 days

[smthakur73]

Each day of the trend chart should show me the total for the last 7 days. For eg:

Apr 7 - sum(Apr 1 - Apr 7)
Apr 8 - sum(Apr 2 - Apr 😎
Apr 9 - sum(Apr 3 - Apr 9)

etc...

This presents a daily improvement for the last 7 days of data set.

[skoelpin]

Use timewrap.. You gotta pipe in a timechart to do it like this

index=.. 
| timechart  span=1h sum(field_name) 
| timewrap 1d

[Sukisen1981]

check out the timewrap function - https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Timewrap