Splunk Search

Why timewrap command only shows current results from today (latest_day)?

hlarimer
Communicator

I am trying to test timewrap and have created the following simple search:

index=_internal source=*metrics.log group="per_index_thruput" | timechart count span=1h | timewrap d

But all I get for results are the results from today (chosen from the timerange picker). In my chart it shows a line for latest_day but nothing else. Any ideas?

Tags (1)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I know this sounds dumb, but is your time frame set to something longer than 1 day? If you have your time frame set to one day, that's exactly what it'll do. Try changing it to "last 7 days" or something.

View solution in original post

Richfez
SplunkTrust
SplunkTrust

I know this sounds dumb, but is your time frame set to something longer than 1 day? If you have your time frame set to one day, that's exactly what it'll do. Try changing it to "last 7 days" or something.

Richfez
SplunkTrust
SplunkTrust

There's an example in the documenatation page of timewrap (https://apps.splunk.com/app/1645/#app-resources) on using timewrap to show today vs. the previous week. Get rid of the eval in the middle, change your table to show s7 and s0 (I think) and you can probably make it work. I'd post a new question if you need a more complete answer.

hlarimer
Communicator

So what I originally tried was to set it for 30 days but I had "earliest=@d latest=now" defined and it failed. Once I removed the time constraints and set the time range picker to 7 days then I got 7 days worth of lines on the graphs.

But what if I only want to show today's vs 7 days ago?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...