Answers for "How do I calculate median values for the column for 7 weeks?"
https://answers.splunk.com/answers/683384/how-do-i-calculate-median-values-for-the-column-fo.html
The latest answers for the question "How do I calculate median values for the column for 7 weeks?"Answer by DalJeanis
https://answers.splunk.com/answering/683443/view.html
To accomplish this, you need to move each of the data points onto the same _time scale.
Here's one way
index=_audit earliest=-7w@d latest=@d
| bin _time span=10m
| stats count as val by _time
| makecontinuous _time span=10m
| fillnull value=0 val
| rename COMMENT as "The above provides run-anywhere sample data"
| rename COMMENT as "Find the latest time, then recalculate every week to put all records into the same (current) week"
| eventstats max(_time) as maxtime
| eval _time=maxtime - ( (maxtime - _time) % 604800)
| rename COMMENT as "display results. For reference while testing, include number of weeks"
| timechart span=10m median(val) as med_val count as nbr_weeks
| rename COMMENT as "kill prior 6 weeks of now-empty rows"
| where _time > relative_time(now(),"-7d@d")Mon, 27 Aug 2018 15:41:56 GMTDalJeanis