Splunk search

LogUx — Mon, 18 Dec 2023 08:44:09 GMT

Hello Splunkers !!

I am getting below while executing the search . Please let me know why this error occurs and help me fix the issue.

Re: Splunk search

splunkreal — Mon, 18 Dec 2023 11:00:10 GMT

Hello @LogUx what is `indextime`for you, is that macro? If yes try replacing by the content of the macro directly.

Re: Splunk search

bowesmana — Mon, 18 Dec 2023 23:14:26 GMT

Your `indextime` is a macro and it's expansion does not work with the >=$info_min_time$

Other points:

The documentation says that map does not work after appendpipe or append commands - see Known limitations

https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/map

Your use of appendpipe in this example is odd in that it does nothing - I assume this is from some more complete search

This search is probably NOT the way you want to do what you are trying to do - given your maxsearch=20000, this may take forever to run if you really have that many searches to run sequentially.

Perhaps you can say what you're trying to achieve as map seems as though it may not be the solution for your scenario.

topic Re: Splunk search in Splunk Enterprise

Splunk search

Re: Splunk search

Re: Splunk search