If you use timewrap without previously using the timechart command, you get a warning "The timewrap command is designed to work on the output of timechart. ". If the format is correct, it works though. For example, these two queries give the same output: | tstats count where index=my_index by _time span=1h | timewrap 1w index=my_index | timechart span=1h count | timewrap 1w  The first query is way faster in this case, but I get the warning mentioned above. (this is not about the tstats command, it is also possible to recreate timechart it with other commands iirc) The docs say: "You must use the timechart command in the search before you use the timewrap command. " (both SPL and SPL2 docs say this) Why is this the case though? Beside the docs and the warning, nothing hints towards this being correct, it works... Am I missing something? If not, is it possible to deactivate the warning?   ... View more