I'm still relatively new to Splunk and am having trouble understanding Timechart and the proper syntax for it. I'm looking to gather 6 months worth of Trend data for compliance purposes. Currently, I've got the following in order to get the initial (monthly) data point so that each month it updates to the new 6 month window:
search query | dedup 2 items | stats count(eval(state="passed")) AS Passed, count(eval(state="failed")) AS Failed | eval Percent_Compliance=(100-((Failed/Passed)*100))
I assume that I want to set the search range as 6 months instead of 1 month, but outside of that I don't really understand how to implement timechart or if there is a better solution. Thank you in advance.