I am using the search below to get a week over week results using Timewrap, but the results shown are from today and not from the day mentioned in the "latest" time modifier (Green line on the chart below).
| mstats sum(foo) as "count" where index=test earliest=-14d@w1 latest=@w1 span=1d
| timechart sum(count) as Exceptions span=1d
| timewrap w
If the timewrap command is removed then timechart displays the results for the correct time period.
Thank you
Since our data is not your data, what do you have for the results with the time wrap
that is not what you want, but right in the result without the timewrap
? Perhaps a screenshot of the latter?
When I tried to reproduce it, I saw @w1 includes today. Try different values to get what you are looking for such as:
earliest=-14d@d-1 latest=@d-1
earliest=-2w@w latest=@w
What version of splunk are you on? I am not seeing this when I use this similar run-anywhere search, which always works no matter what w#
I use:
index=_* earliest=-14d@w1 latest=@w1
| bin _time span=1d
| stats count BY _time
| timechart sum(count) AS Exceptions span=1d
| timewrap w