Why timewrap command only shows current results from today (latest_day)?

[hlarimer]

I am trying to test timewrap and have created the following simple search:

index=_internal source=*metrics.log group="per_index_thruput" | timechart count span=1h | timewrap d

But all I get for results are the results from today (chosen from the timerange picker). In my chart it shows a line for latest_day but nothing else. Any ideas?

[Richfez · Accepted solution]

I know this sounds dumb, but is your time frame set to something longer than 1 day? If you have your time frame set to one day, that's exactly what it'll do. Try changing it to "last 7 days" or something.

[Richfez]

There's an example in the documenatation page of timewrap (https://apps.splunk.com/app/1645/#app-resources) on using timewrap to show today vs. the previous week. Get rid of the eval in the middle, change your table to show s7 and s0 (I think) and you can probably make it work. I'd post a new question if you need a more complete answer.

[hlarimer]

So what I originally tried was to set it for 30 days but I had "earliest=@d latest=now" defined and it failed. Once I removed the time constraints and set the time range picker to 7 days then I got 7 days worth of lines on the graphs.

But what if I only want to show today's vs 7 days ago?