Hi,
index=myindex |search name=*| bin span=1d _time | stats dc(name) as name by _time
here i am getting the number of names in last 7 days with count for each day. Like the image shown.
Now when the count dropped from 140 to 132 i want a query which can show the missing 8 names.
your search is latest=now()
maybe, a few name isn't appeared yet.