topic Re: Why am I getting "Unknown search command ..." when trying to run a macro form the Java SDK? in Splunk Search

Why am I getting "Unknown search command ..." when trying to run a macro form the Java SDK?

lattar — Fri, 06 Mar 2015 14:39:06 GMT

We have a macro set up under 'Advanced search » Search macros', it takes 3 parameters (host, neighborIP, days). To run it from the search box in Splunk I simply put `my_macro(*,*,31)` which works fine. When I try to run this using the Java SDK I get the message "Unknown search command 'host'."
Below is the relevant part of the code

...
jobArgs.setExecutionMode(JobArgs.ExecutionMode.NORMAL);
JobCollection jobs = service.getJobs();
Job job = jobs.create("`my_macro(*,*,31)`", jobArgs);

Needless to say I'm new to Splunk and I may be being a bit dumb but, I can't seem to find information about executing macros with parameters from the SDK in the splunk documentation.

Any help would be very much appreciated

Re: Why am I getting "Unknown search command ..." when trying to run a macro form the Java SDK?

martin_mueller — Fri, 06 Mar 2015 16:40:43 GMT

You may need to prepend the search command to your search job. In the web interface this is done implicitly.

Re: Why am I getting "Unknown search command ..." when trying to run a macro form the Java SDK?

lattar — Mon, 09 Mar 2015 09:25:33 GMT

Thanks very much.

For anyone else with the same issue I changed the command to :

Job job = jobs.create("search `my_macro(*,*,31)`", jobArgs);