topic Re: How come the timewrap command is displaying today's results and not from the value of the day in the timemodifier? in Splunk Search

How come the timewrap command is displaying today's results and not from the value of the day in the timemodifier?

ppokhrel — Thu, 06 Dec 2018 20:18:47 GMT

I am using the search below to get a week over week results using Timewrap, but the results shown are from today and not from the day mentioned in the "latest" time modifier (Green line on the chart below).

| mstats sum(foo) as "count" where index=test earliest=-14d@w1 latest=@w1 span=1d
| timechart sum(count) as Exceptions span=1d
| timewrap w

If the timewrap command is removed then timechart displays the results for the correct time period.

Thank you

Re: How come the timewrap command is displaying today's results and not from the value of the day in the timemodifier?

woodcock — Fri, 14 Dec 2018 16:52:55 GMT

What version of splunk are you on? I am not seeing this when I use this similar run-anywhere search, which always works no matter what w# I use:

index=_* earliest=-14d@w1 latest=@w1
| bin _time span=1d 
| stats count BY _time 
| timechart sum(count) AS Exceptions span=1d 
| timewrap w

Re: How come the timewrap command is displaying today's results and not from the value of the day in the timemodifier?

efavreau — Mon, 17 Dec 2018 20:43:36 GMT

When I tried to reproduce it, I saw @w1 includes today. Try different values to get what you are looking for such as:
earliest=-14d@d-1 latest=@d-1
earliest=-2w@w latest=@w

Re: How come the timewrap command is displaying today's results and not from the value of the day in the timemodifier?

cpetterborg — Fri, 21 Dec 2018 22:06:54 GMT

Since our data is not your data, what do you have for the results with the time wrap that is not what you want, but right in the result without the timewrap? Perhaps a screenshot of the latter?