topic Re: macro with localop? in Knowledge Management https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94125#M957 <P>Vincent,</P> <P>You can have macros that make use of generating commands, but the error is likely correct in that certain search commands (i.e. metadata) must be the first command of a search.</P> <PRE><CODE>## macros.conf [metadata] definition = metadata type=hosts index=* iseval = 0 ## search | `metadata` </CODE></PRE> Tue, 03 May 2011 17:01:39 GMT hazekamp 2011-05-03T17:01:39Z macro with localop? https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94124#M956 <P>Is there any way to start a macro with a generator command? I get the error "The command must be the first command of a search."</P> Tue, 03 May 2011 15:56:52 GMT https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94124#M956 vbumgarner 2011-05-03T15:56:52Z Re: macro with localop? https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94125#M957 <P>Vincent,</P> <P>You can have macros that make use of generating commands, but the error is likely correct in that certain search commands (i.e. metadata) must be the first command of a search.</P> <PRE><CODE>## macros.conf [metadata] definition = metadata type=hosts index=* iseval = 0 ## search | `metadata` </CODE></PRE> Tue, 03 May 2011 17:01:39 GMT https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94125#M957 hazekamp 2011-05-03T17:01:39Z Re: macro with localop? https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94126#M958 <P>We figured that out, but it's kinda lame. It'd be nice to have the pipe in the definition.</P> Tue, 03 May 2011 17:03:56 GMT https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94126#M958 vbumgarner 2011-05-03T17:03:56Z Re: macro with localop? https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94127#M959 <P>It is lame. Can you do it if you make it into an <CODE>iseval=1</CODE> definition returning a string?</P> Tue, 03 May 2011 18:39:20 GMT https://community.splunk.com/t5/Knowledge-Management/macro-with-localop/m-p/94127#M959 gkanapathy 2011-05-03T18:39:20Z