topic Re: Why does timewrap require timechart results? in Splunk Search

Why does timewrap require timechart results?

tiimo — Thu, 08 May 2025 11:27:53 GMT

If you use timewrap without previously using the timechart command, you get a warning "The timewrap command is designed to work on the output of timechart. ".

If the format is correct, it works though.

For example, these two queries give the same output:

| tstats count where index=my_index by _time span=1h | timewrap 1w

index=my_index | timechart span=1h count | timewrap 1w

The first query is way faster in this case, but I get the warning mentioned above. (this is not about the tstats command, it is also possible to recreate timechart it with other commands iirc)

The docs say: "You must use the timechart command in the search before you use the timewrap command. " (both SPL and SPL2 docs say this)

Why is this the case though? Beside the docs and the warning, nothing hints towards this being correct, it works...

Am I missing something? If not, is it possible to deactivate the warning?

Re: Why does timewrap require timechart results?

ITWhisperer — Thu, 08 May 2025 11:48:00 GMT

timewrap is looking for a hidden field called _span

This should work

| tstats count where index=my_index by _time span=1h | eval _span=3600 | timewrap 1w

This should give a warning

index=my_index | timechart span=1h count | fields - _span | timewrap 1w

Re: Why does timewrap require timechart results?

tiimo — Thu, 08 May 2025 11:54:39 GMT

Huh, thanks, that works. This should be changed or at least clarified in the documentation

Re: Why does timewrap require timechart results?

ITWhisperer — Thu, 08 May 2025 12:06:09 GMT

If all these things were documented, there wouldn't be a need for Answers, Splunk Trust and .conf! 🤣

Re: Why does timewrap require timechart results?

isoutamo — Fri, 16 May 2025 16:51:19 GMT

You could also use tstats with prestats=t paramter like

| tstats prestats=t count where index=my_index by _time span=1h
| timechart span=1h count
| timewrap 1w

https://docs.splunk.com/Documentation/Splunk/9.4.2/SearchReference/Tstats