topic Re: Using $starttime$ and $endtime$ in a macro with 'map' in Splunk Search

Using $starttime$ and $endtime$ in a macro with 'map'

phemmer — Wed, 15 May 2013 15:31:37 GMT

I am trying to create a macro which uses $startime$ and $endtime$ in a map. Whenever I do however I get the following error:

Error in 'map': Did not find value for required attribute 'starttime'.

Also this only happens if I specify a search time frame such as "Last 15 minutes". If I specify a custom time frame with specific beginning and end it works.

Here is the macro:

$search$ | localize timebefore=10s timeafter=10s | map search="search ( ($search$) OR ($filter$) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

The parameters are search and filter.

Additionally when I run the macro by hand, substituting the parameters, it works.

For example, this fails:

`surrounding("status>=500 status<=599", "error")`

But this works:

status>=500 status<=599 | localize timebefore=10s timeafter=10s | map search="search ( (status>=500 status<=599) OR (error) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

Re: Using $starttime$ and $endtime$ in a macro with 'map'

kml_uvce — Thu, 16 May 2013 06:09:24 GMT

you are not passing $starttime$ and $endtime$ as arguments in macro call...

-Kamal Bisht

Re: Using $starttime$ and $endtime$ in a macro with 'map'

phemmer — Thu, 16 May 2013 12:22:51 GMT

You are correct, because they are not arguments. See documentation on map and localize.

Re: Using $starttime$ and $endtime$ in a macro with 'map'

sowings — Mon, 28 Sep 2020 13:55:05 GMT

When I had to pass a field through to the map command like this (note: as part of saved search!), I had to double the dollar signs:

Maybe doubling the dollar signs can help you?

Re: Using $starttime$ and $endtime$ in a macro with 'map'

phemmer — Thu, 16 May 2013 14:00:16 GMT

No joy, still gives the same error :-(. Thanks though.

Re: Using $starttime$ and $endtime$ in a macro with 'map'

reed_kelly — Mon, 25 Jun 2018 20:04:40 GMT

Unrelated, but that worked for me when adding a map command (with substitutions) to a dashboard. 🙂