topic Re: Macro Argument not applying in Splunk Search

Macro Argument not applying

ebs — Mon, 24 May 2021 06:02:02 GMT

Hi.

I've created the following macro: sessionCount(1)

With this definition:

datamodel Test summariesonly=true search | search "TEST.date"=$date$ | stats count(exchangeId)

But when I enter this search: | `sessionCount(2021-05-18)` it doesn't work

But this search does: | datamodel Test summariesonly=true search | search "TEST.date"=2021-05-18 | stats count(exchangeId)

What am I doing wrong?

Re: Macro Argument not applying

aasabatini — Mon, 24 May 2021 06:33:12 GMT

Hi @ebs

check if the macro is public or private, also check all the permissions

Regards

Alessandro

Re: Macro Argument not applying

ebs — Mon, 24 May 2021 22:50:47 GMT

I fixed the permissions, but its still not working

Re: Macro Argument not applying

aasabatini — Tue, 25 May 2021 05:50:15 GMT

Hi @ebs

Can you click on the searchand digit this sequence to expand the macro?

crtl+shift+e

New in 6.6, there is now a keystroke to expand macros in the search window! Click inside your search and press cmd-shift-E (on Mac, should be shift-WIN-E on Windows) and you'll see a window like this:

and please share the screen

Regards

Alessandro

Re: Macro Argument not applying

ebs — Tue, 25 May 2021 22:29:28 GMT

It seems it was a permissions issue, just took a while to propagate. Thank you!