I have this search:
| inputlookup mySearch | where foo=bar
Now I'd like to do this:
with definition = | inputlookup mySearch | where foo=$bar$
But it does not work.
I get: Error in 'inputlookup' command: This command must be the first command of a search.
How can i use inputlookup in a macro?
Here's what is happening: Splunk is turning this query
which is then expanded into this:
search | inputlookup yada yada yada
To get around this you need to move the pipe out of the macro and into the search:
This will make sure Splunk does not add the implicit search command.
It happens because Splunk adds an search before MACRO, Savedsearch when it's called. So if you just mention the |inputlookup macro(bar) then it will work. Thanks. There may be some other solution but i can tell this much.