Splunk Search

Is timewrap an official SPL command in Splunk 6.5?

rjthibod
Champion

I noticed that timewrap came up as suggested SPL command in a Splunk 6.5 search box (see attachment). The command does seem to work. I do not have the timewrap app installed on this system.

Is timewrap officially part of the SPL lexicon in 6.5? If so, are people going to encounter significant problems if they have the timewrap installed on a Splunk 6.5 system?

alt text

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Updated:

Yes, the timewrap command was added in 6.5. Documentation is here - http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Updated:

Yes, the timewrap command was added in 6.5. Documentation is here - http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap

skoelpin
SplunkTrust
SplunkTrust

Finally!!

0 Karma

rjthibod
Champion

ddrillic
Ultra Champion

It's an app that has been around for a while.

The following says Timewrap

-- This small app gives you a new, convenient search command called "timewrap" that does it all, for arbitrary time periods. Compare week-over-week, day-over-day, month-over-month, quarter-over-quarter, year-over-year, or any multiple (e.g. two week periods over two week periods).

-- Just add "| timewrap w" after a 'timechart' command, and compare week-over-week. Or use 'h' (hour), 'w' (week), 'm' (month), 'q' (quarter), 'y' (year).

0 Karma

rjthibod
Champion

I downvoted this post because i am sorry, but you must have missed the part of my post that says i do not have the app installed and this suggestions still comes up. this is a clean 6.5 test box.

cmerriman
Super Champion

Timewrap doesn't have a doc page in the Splunk Docs, so it's likely that you'll need the app in order to use the command. If the app is installed correctly, I don't think people will see problems with the command.

0 Karma

rjthibod
Champion

I am sorry @cmerriman, but I do not have the app.

It looks like it is part of 6.5. Response from official Splunk is forthcoming.

You can find info for timewrap in searchbnf.conf in the Splunk 6.5 files.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...