I've following entry in my savedsearches.conf:
[My_Summary_Query] action.email.inline = 1 action.email.reportServerEnabled = 0 action.summary_index = 1 action.summary_index._name = `MY_SUMMARY_MACRO` alert.suppress = 0 alert.track = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -1h@h dispatch.latest_time = @h enableSched = 1 realtime_schedule = 0 search = `MY_MACRO` sourcetype="my_log" | <my query here...> vsid = *:fjdfnv5
The above code works fine & dashboard is displayed fine too. but then in Manager->Searches & Reports, if I click on the above query, it shows
MY_SUMMARY_MACRO in the "Select the summary index" drop-down under "Summary Indexing" section.
And it starts displaying warning above, if I save anything....
Is this an issue in splunk?
No, you can't run a macro there. The only place macros are expanded in when search strings are evaluated.
there is some harm, if only in extra server resources and space being consumed. can you please explain why you have summary indexing enabled, and what you think entering a macro there will do for you?
The reason I added macro is because we've different environments, say alpha, & when I want to deploy in Alpha, I'll simply change the macro to use just different index name...My macro contains only index definition...How would there be an issue exactly, can you explain?
I did some testing on this. This answer is right. What i did is:
Add following into macro.conf:
definition = -3d
Add following into savedsearch.conf:
dispatch.earliesttime = `TimeRangeToGetStatsFrom_All`
This should be equal to put following line to savedsearch.conf file:
dispatch.earliest_time = -3d
But the result is not. The scheduled saved search is running. But not for 3 days data. Instead, it is for all data in the system. I got this from S.o.S. It seems Splunk will use wrong date range if it finds the format is incorrect.