Splunk Search
Highlighted

Is timewrap an official SPL command in Splunk 6.5?

Champion

I noticed that timewrap came up as suggested SPL command in a Splunk 6.5 search box (see attachment). The command does seem to work. I do not have the timewrap app installed on this system.

Is timewrap officially part of the SPL lexicon in 6.5? If so, are people going to encounter significant problems if they have the timewrap installed on a Splunk 6.5 system?

alt text

0 Karma
Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

Ultra Champion

It's an app that has been around for a while.

The following says Timewrap

-- This small app gives you a new, convenient search command called "timewrap" that does it all, for arbitrary time periods. Compare week-over-week, day-over-day, month-over-month, quarter-over-quarter, year-over-year, or any multiple (e.g. two week periods over two week periods).

-- Just add "| timewrap w" after a 'timechart' command, and compare week-over-week. Or use 'h' (hour), 'w' (week), 'm' (month), 'q' (quarter), 'y' (year).

0 Karma
Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

Champion

I downvoted this post because i am sorry, but you must have missed the part of my post that says i do not have the app installed and this suggestions still comes up. this is a clean 6.5 test box.

Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

Super Champion

Timewrap doesn't have a doc page in the Splunk Docs, so it's likely that you'll need the app in order to use the command. If the app is installed correctly, I don't think people will see problems with the command.

0 Karma
Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

Champion

I am sorry @cmerriman, but I do not have the app.

It looks like it is part of 6.5. Response from official Splunk is forthcoming.

You can find info for timewrap in searchbnf.conf in the Splunk 6.5 files.

0 Karma
Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

Splunk Employee
Splunk Employee

Updated:

Yes, the timewrap command was added in 6.5. Documentation is here - http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap

View solution in original post

Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

SplunkTrust
SplunkTrust

Finally!!

0 Karma
Highlighted

Re: Is timewrap an official SPL command in Splunk 6.5?

Champion