https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/483522#M135360 <P>Hi, I am trying to show a comparison of traffic on my website for today, yesterday and last week. I am using below query for getting the results. My query is if i put that into a chart then on x-axis, i get time field which shows time for last 24 hours. So what does it mean exactly?<BR /> I mean does it show the 7 days before on this time, this was the traffic? I am not able to get the _time field understanding here.<BR /> Can someone help?</P> <P>index=web_prod sourcetype=access_combined req_content="/" earliest=-8d@d latest=now <BR /> | timechart count span=1h <BR /> | timewrap d<BR /> | table _time 1day_before 7days_before latest_day</P> Wed, 30 Sep 2020 02:57:47 GMT Shashank_87 2020-09-30T02:57:47Z https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/483522#M135360 <P>Hi, I am trying to show a comparison of traffic on my website for today, yesterday and last week. I am using below query for getting the results. My query is if i put that into a chart then on x-axis, i get time field which shows time for last 24 hours. So what does it mean exactly?<BR /> I mean does it show the 7 days before on this time, this was the traffic? I am not able to get the _time field understanding here.<BR /> Can someone help?</P> <P>index=web_prod sourcetype=access_combined req_content="/" earliest=-8d@d latest=now <BR /> | timechart count span=1h <BR /> | timewrap d<BR /> | table _time 1day_before 7days_before latest_day</P> Wed, 30 Sep 2020 02:57:47 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/483522#M135360 Shashank_87 2020-09-30T02:57:47Z https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/506439#M141697 <P>Got answer for the above?</P> Mon, 29 Jun 2020 03:15:31 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/506439#M141697 Jegan 2020-06-29T03:15:31Z https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/506461#M141701 <P>This would work</P><P>index=webprod sourcetype=accesscombined reqcontent="/" | timechart count span=1h | timewrap d | table _time, _span, 1daybefore, 7daysbefore, latestday</P> Mon, 29 Jun 2020 04:10:58 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/506461#M141701 Jegan 2020-06-29T04:10:58Z https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/506465#M141703 <P>The timewrap normalises all the time series on to the same time window, i.e. in your case the last 24 hours. It will create a new series for each of the days going back in time in your search time range</P><P>I think your field names are not quite right</P><LI-CODE lang="markup">| table _time 1day_before 7days_before latest_day</LI-CODE><P>Missing '_' character in fields&nbsp;</P> Mon, 29 Jun 2020 04:24:19 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-timewrap-Command/m-p/506465#M141703 bowesmana 2020-06-29T04:24:19Z