All Apps and Add-ons

Timewrap app : Using the globally exported "timewrap" command from another app results in "Unknown search command 'timewrap' "

Motivator

I've having an issue with being able to use the timewrap command in any other app than the default search app. I've updating sos dashboards to utilise timewrap and the command won't work. I'm think its something obviously local.meta related but I just can't seem to find it. There isn't another local sos timewrap command so app context precedence from another command isn't coming into play.

I've checked the timewrap apps permissions for the command and they are set to global/all apps. All users have read on the command and "export = system" in timewrap/metadata/local.meta

[commands/timewrap]
access = read : [ * ], write : [ admin ]
export = system

Ideas?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

View solution in original post

Splunk Employee
Splunk Employee

1) When you say it "won't work", what do you mean? What error do you get?

2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup.

3) Maybe there's something in the SOS app that limits the commands? In SOS, it does:
[]
import = search

Perhaps trying changing that import to be "search, timewrap"

View solution in original post

Motivator

That fixed it!!!!! Thanks.

The exact reported error for anyone else that encounters this is "Unknown search command 'timewrap'."

I can't find anything that documents that import option in default/local.meta. It isn't listed in the spec.

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Defaultmetaconf#default.meta.conf.spec

My other question would be why would sos have search listed as the import explicitly?

0 Karma

SplunkTrust
SplunkTrust

By importing apps explicitly, you implicitly de-import all globally shared objects from other apps.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!