Hi, I'm relatively new to creating splunk reports and simple ones have been easy but now I need a shortcut/help to get this done while I am still learning 😉 I am trying to create a report based on one type of event (firewall denies), by policy (the firewall deny group). I have a lot of these types of events coming in from multiple firewalls. I'd like to schedule a report that averages just the previous day's events per firewall deny policy and adds that average to a rolling chart that shows the last 30 days. I'm cognisant of keeping the effort my splunk host has to expend to a minimum so I only want to eval the previous day's events and just add that to a chart that I can download or share. Is that doable? ... View more