How to timewrap for today Format

[Thulasinathan_M]

Hi Splunk Experts,

The timewrap command is using d(24 hr) format, but I'm wondering is it possible to make it Today format.

Ex: If Current time is 10AM, then it's displaying timechart of 12 AM to 10AM (12, 14, 16, 18, 20, 22, 00, 02, 04, 06, 08, 10), but I'm looking for 00 AM to 22 (00, 02, 04, 06, 08, 10, 12, 14, 16, 18, 20, 22).

Any advice would be much appreciated.

index="_internal" error
| timechart span=10m count as Counts 
| timewrap d series=exact time_format="%Y-%m-%d"

[yuanliu · Accepted solution]

First of all, thanks for introducing me to timewrap😎 (which arrived in Splunk 7).  Back in Splunk 5, I was bugging veterans in this board to help with a clumsy attempt to wrap.

Timechart is governed by a pair of internal, write-only fields info_min_time and info_max_time determined at search time.  All you need to do is to shift search window.

index="_internal" error latest=+1d@d
| timechart span=10m count as Counts 
| timewrap d series=exact time_format="%Y-%m-%d"

Because you are at 10AM now, if your time selector is, say last 7 days, you'll get some weird artifact whereby 10 first hours in the first day is actually cut off.  To rectify, specify - either in selector or in your search that you want to start at the beginning of that first day.  E.g.,

index="_internal" error earliest=-7d@d latest=+1d@d
| timechart span=10m count as Counts 
| timewrap d series=exact time_format="%Y-%m-%d"

Hope this helps.

[Thulasinathan_M]

Wow, that's a very useful information. Thanks for explaining @yuanliu. It's working perfectly!!! 🙂