Splunk aggregate by day. .