Timewrap app : Using the globally exported "timewrap" command from another app results in "Unknown search command 'timewrap' "

[Lucas_K]

I've having an issue with being able to use the timewrap command in any other app than the default search app. I've updating sos dashboards to utilise timewrap and the command won't work. I'm think its something obviously local.meta related but I just can't seem to find it. There isn't another local sos timewrap command so app context precedence from another command isn't coming into play.

I've checked the timewrap apps permissions for the command and they are set to global/all apps. All users have read on the command and "export = system" in timewrap/metadata/local.meta

[commands/timewrap]
access = read : [ * ], write : [ admin ]
export = system

Ideas?

[carasso · Accepted solution]

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

[Lucas_K]

That fixed it!!!!! Thanks.

The exact reported error for anyone else that encounters this is "Unknown search command 'timewrap'."

I can't find anything that documents that import option in default/local.meta. It isn't listed in the spec.

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Defaultmetaconf#default.meta.conf.spec

My other question would be why would sos have search listed as the import explicitly?

[martin_mueller]

By importing apps explicitly, you implicitly de-import all globally shared objects from other apps.