topic Re: I have developed a good search, but need to notify a recovery or alert depending on the output of the search. The difference between the two outcomes is just a couple of lines that I have not been able to configure in a single search in Splunk Search

I have developed a good search, but need to notify a recovery or alert depending on the output of the search. The difference between the two outcomes is just a couple of lines that I have not been able to configure in a single search

rcole2 — Mon, 10 Apr 2017 14:05:15 GMT

Snippet of search
SEARCH
| eval runmacro = if(deltadif="NO","TurnTimeRecovered","TurnTimeWarning")
runmacro

comment(" +++++++++TurnTimeWarning | where alertnamecount>0 | where alertnamecount=(count+1) +++++++++++++++ ")

comment(" +++++++++TurnTimeRecovered | where alertnamecount=0 | head 1 | where count=1 | where deltadif = "NO" ++++++++++++ ")

The macros exist and the comments above are the exact macros. From the 'deltadif' value I need to perform one of the above macros. This runs successfully, but it appears the macro is not executing. When I run each one inline, they function as expected, but require a unique search for each.
Can a variable be set as a macro and be called; if so how? Or is there a better solution?

Re: I have developed a good search, but need to notify a recovery or alert depending on the output of the search. The difference between the two outcomes is just a couple of lines that I have not been able to configure in a single search

woodcock — Mon, 10 Apr 2017 17:17:02 GMT

Yes, like this:

.... | eval runmacro = if(deltadif="NO","`TurnTimeRecovered`","`TurnTimeWarning`")
| map search="search Other Stuff Here | `$runmacro$`"

Re: I have developed a good search, but need to notify a recovery or alert depending on the output of the search. The difference between the two outcomes is just a couple of lines that I have not been able to configure in a single search

woodcock — Tue, 11 Apr 2017 01:43:14 GMT

You can turn this inside-out and do the same thing with a subsearch:
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchTutorial/Useasubsearch

The 2 templatizing approaches are map and subsearch.

Re: I have developed a good search, but need to notify a recovery or alert depending on the output of the search. The difference between the two outcomes is just a couple of lines that I have not been able to configure in a single search

rcole2 — Wed, 12 Apr 2017 17:48:57 GMT

That's what I wasn't considering -- running separate search. Thanks for the guidance; it does appear to give me what I'm looking for.