Knowledge Management

While calling macro with Argument, "Error in 'SearchParser'" Error is thrown

jshanaiah
Explorer

I have Configured Macro with arguments,

While calling the macroname with arguments ,

It is throwing error

Error in 'SearchParser': Missing a search command before ' '.

Please let me know why I am seeing this..

Thanks

Tags (1)
0 Karma

DaveO35
Explorer

I see this is an older question, hopefully you found a solution to this. I was just working though a similar issue when I found this post. I found the issue to be a hard return at the end of my macro. I was cutting and pasting from an external editor and had grabbed a hard return on the end by accident. My error was something along the lines of 'last argument of appendcols must be a subsearch'. After I removed that hard return, it worked.

jshanaiah
Explorer

Hi,

Macro Search string used is as follows,

index=trans tranTypeId = 1 AND tranDestinationId=1 AND promoCode=$promocode$| eval series="Total Registrations Atempts" | chart count by series

registrationPromo(1) is the name of the macro..

0 Karma

rroberts
Splunk Employee
Splunk Employee

Can you post the macro search string and the name of the macro here please?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...