Why does timewrap require timechart results?

[tiimo]

If you use timewrap without previously using the timechart command, you get a warning "The timewrap command is designed to work on the output of timechart. ".

If the format is correct, it works though.

For example, these two queries give the same output:

| tstats count where index=my_index by _time span=1h
| timewrap 1w

index=my_index
| timechart span=1h count 
| timewrap 1w

 The first query is way faster in this case, but I get the warning mentioned above. (this is not about the tstats command, it is also possible to recreate timechart it with other commands iirc)

The docs say: "You must use the timechart command in the search before you use the timewrap command. " (both SPL and SPL2 docs say this)

Why is this the case though? Beside the docs and the warning, nothing hints towards this being correct, it works...

Am I missing something? If not, is it possible to deactivate the warning?

[isoutamo]

You could also use tstats with prestats=t paramter like

| tstats prestats=t count where index=my_index by _time span=1h
| timechart span=1h count
| timewrap 1w

 https://docs.splunk.com/Documentation/Splunk/9.4.2/SearchReference/Tstats

[ITWhisperer · Accepted solution]

timewrap is looking for a hidden field called _span

This should work

| tstats count where index=my_index by _time span=1h
| eval _span=3600
| timewrap 1w

 This should give a warning

index=my_index
| timechart span=1h count 
| fields - _span
| timewrap 1w

[tiimo]

Huh, thanks, that works. This should be changed or at least clarified in the documentation

[ITWhisperer]

If all these things were documented, there wouldn't be a need for Answers, Splunk Trust and .conf! 🤣