Why am I getting error "Unknown search command 'timewrap'."?

[chethan_kumar01]

Hello,

I am trying to execute the timewrap command with the search string below, however, I am getting

"Unknown search command 'timewrap'. "

Search String:

index=main sourceType=Tran | timechar span=1h | timewrap 1w

App: Search & Reporting
Splunk Enterprise version: 6.2.5

Please let me know.

Thanks,
Chethan

[lguinn2 · Accepted solution]

The timewrap command is not built into Splunk. In order to use it, you need to install the free timewrap app from Splunkbase.

[chethan_kumar01]

thank you.