Using the Year/Annual Timewrap

[AlyssaR]

I've been trying to get a year-over-year graph using timewrap, but I can't seem to get it working. My queries are in the form:

[search terms] | timechart count by someField | timewrap y

I get the following error:

External search command 'timewrap'
returned error code -1. Script output
= "ERROR " 'timeunit' argument required, such as s (seconds), h
(hours), d (days), w (weeks), y
(years). Optionally prefix with a
number: 600s (10 minutes), 2w (2
weeks)." "

I've tried using timewrap y and 1y but neither worked. Using months or weeks worked fine though, including "timewrap 12m" which makes me wonder if it's just an issue with the year option.

The app is updated, and for my time range I've tried "All time" and the last 4 years. The search is generating results fine (somewhere around 2,000 for the most part), so it shouldn't be overwhelmed with too many events.

Think this is an issue on my end or have other problems using this option been documented before?

[carasso]

I've uploaded a new version that supports "y" (years). There was a mismatch between the message and the validation code. It assumes 365 to a year, ignoring leap days.

[AlyssaR]

Updated the app and restarted Splunk, but still getting the same error. Thoughts on what's causing the different results for each of us?