All Apps and Add-ons

Using the Year/Annual Timewrap

AlyssaR
Explorer

I've been trying to get a year-over-year graph using timewrap, but I can't seem to get it working. My queries are in the form:

[search terms] | timechart count by someField | timewrap y

I get the following error:

External search command 'timewrap'
returned error code -1. Script output
= "ERROR " 'timeunit' argument required, such as s (seconds), h
(hours), d (days), w (weeks), y
(years). Optionally prefix with a
number: 600s (10 minutes), 2w (2
weeks)." "

I've tried using timewrap y and 1y but neither worked. Using months or weeks worked fine though, including "timewrap 12m" which makes me wonder if it's just an issue with the year option.

The app is updated, and for my time range I've tried "All time" and the last 4 years. The search is generating results fine (somewhere around 2,000 for the most part), so it shouldn't be overwhelmed with too many events.

Think this is an issue on my end or have other problems using this option been documented before?

Tags (3)

carasso
Splunk Employee
Splunk Employee

I've uploaded a new version that supports "y" (years). There was a mismatch between the message and the validation code. It assumes 365 to a year, ignoring leap days.

AlyssaR
Explorer

Updated the app and restarted Splunk, but still getting the same error. Thoughts on what's causing the different results for each of us?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!