- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vbumgarner
Contributor
05-03-2011
08:56 AM
Is there any way to start a macro with a generator command? I get the error "The command must be the first command of a search."
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hazekamp
Builder
05-03-2011
10:01 AM
Vincent,
You can have macros that make use of generating commands, but the error is likely correct in that certain search commands (i.e. metadata) must be the first command of a search.
## macros.conf
[metadata]
definition = metadata type=hosts index=*
iseval = 0
## search
| `metadata`
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hazekamp
Builder
05-03-2011
10:01 AM
Vincent,
You can have macros that make use of generating commands, but the error is likely correct in that certain search commands (i.e. metadata) must be the first command of a search.
## macros.conf
[metadata]
definition = metadata type=hosts index=*
iseval = 0
## search
| `metadata`
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gkanapathy

Splunk Employee
05-03-2011
11:39 AM
It is lame. Can you do it if you make it into an iseval=1
definition returning a string?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vbumgarner
Contributor
05-03-2011
10:03 AM
We figured that out, but it's kinda lame. It'd be nice to have the pipe in the definition.
