Archive
Highlighted

Using Macro in savedsearches.conf

Path Finder

Hi,

I've following entry in my savedsearches.conf:

[My_Summary_Query]
action.email.inline = 1
action.email.reportServerEnabled = 0
action.summary_index = 1
action.summary_index._name = `MY_SUMMARY_MACRO`
alert.suppress = 0
alert.track = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -1h@h
dispatch.latest_time = @h
enableSched = 1
realtime_schedule = 0
search = `MY_MACRO` sourcetype="my_log" | <my query here...> 
vsid = *:fjdfnv5

The above code works fine & dashboard is displayed fine too. but then in Manager->Searches & Reports, if I click on the above query, it shows MY_SUMMARY_MACRO in the "Select the summary index" drop-down under "Summary Indexing" section.

And it starts displaying warning above, if I save anything....

Is this an issue in splunk?

Thanks!

Tags (1)
0 Karma
Highlighted

Re: Using Macro in savedsearches.conf

Splunk Employee
Splunk Employee

No, you can't run a macro there. The only place macros are expanded in when search strings are evaluated.

View solution in original post

Highlighted

Re: Using Macro in savedsearches.conf

Path Finder

But there is no harm in putting these macros as shown above, right?

0 Karma
Highlighted

Re: Using Macro in savedsearches.conf

Splunk Employee
Splunk Employee

there is some harm, if only in extra server resources and space being consumed. can you please explain why you have summary indexing enabled, and what you think entering a macro there will do for you?

0 Karma
Highlighted

Re: Using Macro in savedsearches.conf

Path Finder

The reason I added macro is because we've different environments, say alpha, & when I want to deploy in Alpha, I'll simply change the macro to use just different index name...My macro contains only index definition...How would there be an issue exactly, can you explain?

0 Karma
Highlighted

Re: Using Macro in savedsearches.conf

Path Finder

I did some testing on this. This answer is right. What i did is:

Add following into macro.conf:

[TimeRangeToGetStatsFromAll]
definition = -3d

Add following into savedsearch.conf:

dispatch.earliesttime = `TimeRangeToGetStatsFrom_All`

This should be equal to put following line to savedsearch.conf file:

dispatch.earliest_time = -3d

But the result is not. The scheduled saved search is running. But not for 3 days data. Instead, it is for all data in the system. I got this from S.o.S. It seems Splunk will use wrong date range if it finds the format is incorrect.

0 Karma