All Apps and Add-ons

Using the Year/Annual Timewrap

AlyssaR
Explorer

I've been trying to get a year-over-year graph using timewrap, but I can't seem to get it working. My queries are in the form:

[search terms] | timechart count by someField | timewrap y

I get the following error:

External search command 'timewrap'
returned error code -1. Script output
= "ERROR " 'timeunit' argument required, such as s (seconds), h
(hours), d (days), w (weeks), y
(years). Optionally prefix with a
number: 600s (10 minutes), 2w (2
weeks)." "

I've tried using timewrap y and 1y but neither worked. Using months or weeks worked fine though, including "timewrap 12m" which makes me wonder if it's just an issue with the year option.

The app is updated, and for my time range I've tried "All time" and the last 4 years. The search is generating results fine (somewhere around 2,000 for the most part), so it shouldn't be overwhelmed with too many events.

Think this is an issue on my end or have other problems using this option been documented before?

Tags (3)

carasso
Splunk Employee
Splunk Employee

I've uploaded a new version that supports "y" (years). There was a mismatch between the message and the validation code. It assumes 365 to a year, ignoring leap days.

AlyssaR
Explorer

Updated the app and restarted Splunk, but still getting the same error. Thoughts on what's causing the different results for each of us?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...