Splunk Search

Why timewrap command only shows current results from today (latest_day)?

hlarimer
Communicator

I am trying to test timewrap and have created the following simple search:

index=_internal source=*metrics.log group="per_index_thruput" | timechart count span=1h | timewrap d

But all I get for results are the results from today (chosen from the timerange picker). In my chart it shows a line for latest_day but nothing else. Any ideas?

Tags (1)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I know this sounds dumb, but is your time frame set to something longer than 1 day? If you have your time frame set to one day, that's exactly what it'll do. Try changing it to "last 7 days" or something.

View solution in original post

Richfez
SplunkTrust
SplunkTrust

I know this sounds dumb, but is your time frame set to something longer than 1 day? If you have your time frame set to one day, that's exactly what it'll do. Try changing it to "last 7 days" or something.

Richfez
SplunkTrust
SplunkTrust

There's an example in the documenatation page of timewrap (https://apps.splunk.com/app/1645/#app-resources) on using timewrap to show today vs. the previous week. Get rid of the eval in the middle, change your table to show s7 and s0 (I think) and you can probably make it work. I'd post a new question if you need a more complete answer.

hlarimer
Communicator

So what I originally tried was to set it for 30 days but I had "earliest=@d latest=now" defined and it failed. Once I removed the time constraints and set the time range picker to 7 days then I got 7 days worth of lines on the graphs.

But what if I only want to show today's vs 7 days ago?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...