Timewrap command – timewrap command in splunk is used to compare data over specific time period, such as day-over-day or month-over-month. Also used to compare multiple time periods, such as a two week period over another two week period.

Splunk Command  – >  | timechart count span=1d | timewrap 1week

Usage

  • The timewrap command is a reporting command.
  • Timechart command in the search before you use the timewrap command.

Basic example:

• Display a timechart, showing comparison of day over previous week| tstats count where index=asa groupby index,_time span=1d | timechart span=1d avg(count) as eventcount| timewrap 1w | eval difference= eventcount_1week_before  -eventcount_latest_week | eval Date_before_1w=_time-604800|eval Day=strftime(_time,”%A”) |table Day  _time eventcount_latest_week Date_before_1w eventcount_1week_before difference | rename _time as Latest_Date | convert timeformat=”%Y-%m-%d” ctime(*Date*)