topic Re: Use of Timewrap command to control the time range in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463956#M80009 <P>timewrap 10h</P> <P>12p -10p is 10 hours</P> <P>drop earliest and latest from your search and update timewrap to 10h</P> Sat, 08 Feb 2020 15:39:18 GMT jkat54 2020-02-08T15:39:18Z Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463951#M80004 <P>Hi, I am trying to plat a graph of response time over a period of time. I am using timewrap command to plot it for yesterday, day before yesterday and last week.<BR /> The problem is I only want it for a certain period of time on the day. For Example between 12:00 PM to 10:00 PM (peak hours).<BR /> I am snapping the time in the search itself like this earliest=-7d@d+3h latest=@d but is not working. Please see the graph - on the x-axis it is still plotting from 12:00 AM but what i want is from 12:00 PM.</P> <P>earliest=-7d@d+3h latest=@d</P> <P>Any help is appreciated.<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8343i85986DB6B6F149C0/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 08 Feb 2020 12:48:05 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463951#M80004 Shashank_87 2020-02-08T12:48:05Z Re: Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463952#M80005 <P>Please share the spl queries you've attempted</P> Sat, 08 Feb 2020 12:59:55 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463952#M80005 jkat54 2020-02-08T12:59:55Z Re: Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463953#M80006 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/199197">@jkat54</a> This is the query -<BR /> index=tp_test sourcetype=access_combined_wcookie earliest=-8d@d+3h latest=@d<BR /> | timechart span=15m avg(response_time_sec) as AvgResponseTime<BR /> | timewrap d<BR /> | fields _time,AvgResponseTime_latest_day,AvgResponseTime_1day_before,AvgResponseTime_7days_before</P> Wed, 30 Sep 2020 04:04:16 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463953#M80006 Shashank_87 2020-09-30T04:04:16Z Re: Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463954#M80007 <P>I think you need a number in front of the units:</P> <P>| timewrap 1d</P> Sat, 08 Feb 2020 13:44:25 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463954#M80007 jkat54 2020-02-08T13:44:25Z Re: Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463955#M80008 <P>I dont think that matters. The problem is I want to compare the results from 12:00 PM to 10:00 PM.<BR /> Right now it's coming for full day which i don't want.<BR /> I think this is what needs to be modified : earliest=-8d@d+3h latest=@d</P> Sat, 08 Feb 2020 13:50:25 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463955#M80008 Shashank_87 2020-02-08T13:50:25Z Re: Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463956#M80009 <P>timewrap 10h</P> <P>12p -10p is 10 hours</P> <P>drop earliest and latest from your search and update timewrap to 10h</P> Sat, 08 Feb 2020 15:39:18 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463956#M80009 jkat54 2020-02-08T15:39:18Z Re: Use of Timewrap command to control the time range https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463957#M80010 <PRE><CODE>your search | where relative_time(now(),"-8d@d+12h") &lt;= _time </CODE></PRE> <P><CODE>earliest=-8d@d+3h</CODE> is 03:00 AM, but <CODE>timechart</CODE> starts at 00:00 AM.<BR /> I don't know why.</P> <P>Why not limit the display period?</P> Sat, 08 Feb 2020 20:59:40 GMT https://community.splunk.com/t5/Getting-Data-In/Use-of-Timewrap-command-to-control-the-time-range/m-p/463957#M80010 to4kawa 2020-02-08T20:59:40Z