Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

timewrap command overview

The timewrap command displays, or wraps, the output of the timechart command so that every period of time is a different series.

Use the timewrap command to compare data over specific time period, such as day-over-day or month-over-month. You can also use the timewrap command to compare multiple time periods, such as a two week period over another two week period. See timewrap command syntax details.


The required syntax is in bold.

[align=now | end]

How the timewrap command works

Because he timewrap command is used with the timechart command, let's start with that.

The following search counts the number of earthquakes in Alaska where the magnitude is greater than or equal to 5.3. The results are organized in spans of 1 day.

|search source=all_month.csv place=*alaska* mag>=5.3 | timechart count() span=1d

The results look something like this:

_time count
2019-09-08 1
2019-09-09 1
2019-09-10 1
2019-09-11 0
2019-09-12 0
2019-09-13 0
2019-09-14 1
2019-09-15 0
2019-09-16 0
The results continue through 2019-09-23 but are truncated in this example.

Combining the timewrap and timechart commands

Now let's add the timewrap command to the search and specify a <timewrap-span> of 1week.

|search source=all_month.csv place=*alaska* mag>=5.3 | timechart count() span=1d | timewrap 1week

The results are organized based on the day you run the search, which in this example 2019-10-02. Going back in 1 week increments to the week that the data starts (2019-09-08), the results look something like this:

_time 3weeks_before 2weeks_before 1week_before
2019-09-26 0 0
2019-09-27 0 0
2019-09-28 1 0
2019-09-29 1 0 0
2019-09-30 1 0 1
2019-10-01 1 0
2019-10-02 0 0

Using the <timewrap-span> argument

The <timewrap-span> you specify controls how many rows are returned in the results and the ranges for the counts displayed in the columns. The <timewrap-span> specified is 1week so there are 7 rows in the output. Counting back from 2019-10-02, there are 3 weeks between 2019-10-02 and 2019-09-08, which is why the column headings refer to 3 weeks, 2 weeks, and 1 week before.

The first date in the output is 2019-09-26. Counting back 3 weeks is 2019-09-05. There are no events for that date, which is why the output contains no value in the column 3weeks_before for 2019-09-26.

Look at the date 2019-09-29. Counting back 3 weeks is 2019-09-08. There is 1 earthquake for that date, as shown in the results for the first search.

This pattern continues for the rest of the results.

See also

timewrap command
timewrap command syntax details
timewrap command usage
timewrap command examples
Related information
timechart command overview
Last modified on 31 October, 2020
timechart command examples
timewrap command syntax details

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters