https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581743#M202661 <P>I am trying to assign a value to a parameter in a macro that is based on a calculation of a value being sent to the macro but I do not get the expected result.<BR />index=my_index ... earliest=exact($time$-4000) latest=$time$...<BR /><BR />How can I assign the earliest value which suppose to be 4,000 seconds less than the value $time$ ?</P> Wed, 19 Jan 2022 21:02:05 GMT eranhauser 2022-01-19T21:02:05Z https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581743#M202661 <P>I am trying to assign a value to a parameter in a macro that is based on a calculation of a value being sent to the macro but I do not get the expected result.<BR />index=my_index ... earliest=exact($time$-4000) latest=$time$...<BR /><BR />How can I assign the earliest value which suppose to be 4,000 seconds less than the value $time$ ?</P> Wed, 19 Jan 2022 21:02:05 GMT https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581743#M202661 eranhauser 2022-01-19T21:02:05Z https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581769#M202669 <P>exact() is an eval operation, so you can't use that as part of what looks like your search query, it has to be done in an | eval .... statement</P><P>Can you give an example of how you are using the macro and at what point in the search? Where is your original time variable parameter coming from that you are passing in.</P><P>&nbsp;</P> Wed, 19 Jan 2022 22:11:42 GMT https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581769#M202669 bowesmana 2022-01-19T22:11:42Z https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581790#M202674 <P>I am passing a unix date as the latest value and I would like to to set the earliest always to be 4,000 second less</P> Thu, 20 Jan 2022 01:11:13 GMT https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581790#M202674 eranhauser 2022-01-20T01:11:13Z https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581793#M202676 <P>How are you passing the date? Is this part of a dashboard query where the date comes from a token?</P><P>In your example it looks like your macro starts with 'index=...' so implies it's the start of a search or a subsearch, so I am assuming your date is coming from a token. If so, then there's probably a different way to do this, by setting the earliest to be 4000 seconds prior to the latest</P><P>Can you share more&nbsp; about the context or your SPL</P><P>&nbsp;</P> Thu, 20 Jan 2022 01:51:22 GMT https://community.splunk.com/t5/Splunk-Search/macro-with-calculated-parameters/m-p/581793#M202676 bowesmana 2022-01-20T01:51:22Z