Hello, I'm a total Splunk novice, so sorry if this is a completely obvious solution. I have a SingleValue visualization that I'd like to add a trend component to (so I'm switching from `stats count` to `timechart count`. The issue is that I want the discrete events to be aggregated into a single count based on a span consistent with the time picker. The default timechart behavior has all events being counted separately. Example: Timepicker input is set to last 24 hours. I now want my timechart command to have a span of 24h. This should work dynamically with any timepicker value. From what I've researched so far, it looks as though I need to mess around with the source xml, and some tokens, but I'm not sure what exactly to do. I tried to simply set `span = $time_tok$`, but that was not successful. Thanks for the help in advance!
... View more
