To accomplish this, you need to move each of the data points onto the same _time scale. Here's one way index=_audit earliest=-7w@d latest=@d | bin _time span=10m | stats count as val by _time | makecontinuous _time span=10m | fillnull value=0 val | rename COMMENT as "The above provides run-anywhere sample data" | rename COMMENT as "Find the latest time, then recalculate every week to put all records into the same (current) week" | eventstats max(_time) as maxtime | eval _time=maxtime - ( (maxtime - _time) % 604800) | rename COMMENT as "display results. For reference while testing, include number of weeks" | timechart span=10m median(val) as med_val count as nbr_weeks | rename COMMENT as "kill prior 6 weeks of now-empty rows" | where _time > relative_time(now(),"-7d@d") ... View more

Hi @belts, Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!! ... View more