How come the timewrap command is displaying today's results and not from the value of the day in the timemodifier?

[ppokhrel]

I am using the search below to get a week over week results using Timewrap, but the results shown are from today and not from the day mentioned in the "latest" time modifier (Green line on the chart below).

| mstats sum(foo) as "count" where index=test earliest=-14d@w1 latest=@w1 span=1d
| timechart sum(count) as Exceptions span=1d
| timewrap w

If the timewrap command is removed then timechart displays the results for the correct time period.

Thank you

[cpetterborg]

Since our data is not your data, what do you have for the results with the time wrap that is not what you want, but right in the result without the timewrap? Perhaps a screenshot of the latter?

[efavreau]

When I tried to reproduce it, I saw @w1 includes today. Try different values to get what you are looking for such as:
earliest=-14d@d-1 latest=@d-1
earliest=-2w@w latest=@w

[woodcock]

What version of splunk are you on? I am not seeing this when I use this similar run-anywhere search, which always works no matter what w# I use:

index=_* earliest=-14d@w1 latest=@w1
| bin _time span=1d 
| stats count BY _time 
| timechart sum(count) AS Exceptions span=1d 
| timewrap w