topic Re: Using Macro in savedsearches.conf in Splunk Search

Using Macro in savedsearches.conf

freephoneid — Mon, 03 Oct 2011 18:01:06 GMT

Hi,

I've following entry in my savedsearches.conf:

[My_Summary_Query]
action.email.inline = 1
action.email.reportServerEnabled = 0
action.summary_index = 1
action.summary_index._name = `MY_SUMMARY_MACRO`
alert.suppress = 0
alert.track = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -1h@h
dispatch.latest_time = @h
enableSched = 1
realtime_schedule = 0
search = `MY_MACRO` sourcetype="my_log" | <my query here...> 
vsid = *:fjdfnv5

The above code works fine & dashboard is displayed fine too. but then in Manager->Searches & Reports, if I click on the above query, it shows MY_SUMMARY_MACRO in the "Select the summary index" drop-down under "Summary Indexing" section.

And it starts displaying warning above, if I save anything....

Is this an issue in splunk?

Thanks!

Re: Using Macro in savedsearches.conf

gkanapathy — Mon, 03 Oct 2011 18:20:46 GMT

No, you can't run a macro there. The only place macros are expanded in when search strings are evaluated.

Re: Using Macro in savedsearches.conf

freephoneid — Mon, 03 Oct 2011 18:35:54 GMT

But there is no harm in putting these macros as shown above, right?

Re: Using Macro in savedsearches.conf

gkanapathy — Mon, 03 Oct 2011 18:39:05 GMT

there is some harm, if only in extra server resources and space being consumed. can you please explain why you have summary indexing enabled, and what you think entering a macro there will do for you?

Re: Using Macro in savedsearches.conf

freephoneid — Mon, 03 Oct 2011 18:43:54 GMT

The reason I added macro is because we've different environments, say alpha, & when I want to deploy in Alpha, I'll simply change the macro to use just different index name...My macro contains only index definition...How would there be an issue exactly, can you explain?

Re: Using Macro in savedsearches.conf

tonopahtaos — Mon, 28 Sep 2020 12:41:48 GMT

I did some testing on this. This answer is right. What i did is:

Add following into macro.conf:

[Time_Range_To_Get_Stats_From_All]
definition = -3d

Add following into savedsearch.conf:

dispatch.earliest_time = Time_Range_To_Get_Stats_From_All

This should be equal to put following line to savedsearch.conf file:

dispatch.earliest_time = -3d

But the result is not. The scheduled saved search is running. But not for 3 days data. Instead, it is for all data in the system. I got this from S.o.S. It seems Splunk will use wrong date range if it finds the format is incorrect.