What is the max character limit for a macro?

[hulahoop]

I have a macro which does not work when invoked in a search, but does work when the contents are cut and paste directly into the search. I'm guessing this is due to a max character limit for macros. This macro is 27,000+ characters. 🙂

[hulahoop]

no updates, but will be onsite with customer next week, will update then

[chinmayc469]

Hi,

did you get solution for this issue, even i am facing same issue.

[araitz]

any update to this issue?

[Genti]

27,000+? holy macro!!

[araitz]

Hi hulahoop!

Do you see any errors thrown in splunkd.log?

My guess is that you are expanding past the default macro recursion depth as defined in limits.conf:

# max recursion depth for macros
# considered a search exception if macro expansion doesn't stop after this many levels
max_macro_depth = 100

If it fails silently, that's not good. Try appending "|format" to the end of the macro search and see if there are more than 100 levels of recursion in the resulting format string.