Consider the following pair of macros, the former of which functions as expected whereas the latter fails with an error:
[fl] # stands for First and Last
definition = stats count min(_time) as FIRST, max(_time) as LAST by source | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"
[fl(1)] # stands for First and Last
args StatsBy
definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"
The error I get is this:
Error in 'SearchParser': Could not find macro 'fl' that takes 1 arguments. Expecting stanza name 'fl(1)'.
It seems like you're missing the equal sign after your args
of the second stanza.
[fl(1)] # stands for First and Last
args = StatsBy
definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
It seems like you're missing the equal sign after your args
of the second stanza.
[fl(1)] # stands for First and Last
args = StatsBy
definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!