All Apps and Add-ons

Timewrap app : Using the globally exported "timewrap" command from another app results in "Unknown search command 'timewrap' "

Lucas_K
Motivator

I've having an issue with being able to use the timewrap command in any other app than the default search app. I've updating sos dashboards to utilise timewrap and the command won't work. I'm think its something obviously local.meta related but I just can't seem to find it. There isn't another local sos timewrap command so app context precedence from another command isn't coming into play.

I've checked the timewrap apps permissions for the command and they are set to global/all apps. All users have read on the command and "export = system" in timewrap/metadata/local.meta

[commands/timewrap]
access = read : [ * ], write : [ admin ]
export = system

Ideas?

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

View solution in original post

carasso
Splunk Employee
Splunk Employee

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

Lucas_K
Motivator

That fixed it!!!!! Thanks.

The exact reported error for anyone else that encounters this is "Unknown search command 'timewrap'."

I can't find anything that documents that import option in default/local.meta. It isn't listed in the spec.

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Defaultmetaconf#default.meta.conf.spec

My other question would be why would sos have search listed as the import explicitly?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

By importing apps explicitly, you implicitly de-import all globally shared objects from other apps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...