I have Splunk monitoring a directory of CSV files that imports events using the date the file was created. This runs fortnightly so my timeline only shows events every 14 days.
I'd like to be able to timechart over the previous 6 months, the number of events and have it span the dates from the timeline. I don't want the data to be bucketed together as it is a point in time snapshot and bucketing together will provide inaccurate results. But I want to avoid the peaks and troughs it would create by creating too short a span.