All Apps and Add-ons

Timewrap app : Using the globally exported "timewrap" command from another app results in "Unknown search command 'timewrap' "

Lucas_K
Motivator

I've having an issue with being able to use the timewrap command in any other app than the default search app. I've updating sos dashboards to utilise timewrap and the command won't work. I'm think its something obviously local.meta related but I just can't seem to find it. There isn't another local sos timewrap command so app context precedence from another command isn't coming into play.

I've checked the timewrap apps permissions for the command and they are set to global/all apps. All users have read on the command and "export = system" in timewrap/metadata/local.meta

[commands/timewrap]
access = read : [ * ], write : [ admin ]
export = system

Ideas?

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

View solution in original post

carasso
Splunk Employee
Splunk Employee

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

Lucas_K
Motivator

That fixed it!!!!! Thanks.

The exact reported error for anyone else that encounters this is "Unknown search command 'timewrap'."

I can't find anything that documents that import option in default/local.meta. It isn't listed in the spec.

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Defaultmetaconf#default.meta.conf.spec

My other question would be why would sos have search listed as the import explicitly?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

By importing apps explicitly, you implicitly de-import all globally shared objects from other apps.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...