Reporting

call a savedsearch calling a macro from the CLI

mataharry
Communicator

I have a problem with that :

a macro that fills a new field
[mymacro]
definition = eval now_time=now() | convert ctime(now_time) timeformat="%d/%m/%Y %H:%M:%S"
iseval = 0

a saved search calling that macro
[testmacro]
is_visible = 1
search = index=_internal * earliest=-5d | `mymacro` |  table now_time

____
If i call the macro from the GUI, no problem
index=_internal * earliest=-5d | `mymacro` |  table now_time

If I call the macro from the CLI, no problem (after escaping the `)
./splunk search ' index=_internal * earliest=-5d | `mymacro` |  table now_time' 
or
./splunk search " index=_internal * earliest=-5d | \`mymacro\` |  table now_time" 

____

But if I call the savedsearch calling the macro , it's spreading error
from the CLI
./splunk search '| savedsearch testmacro '
Error in 'SearchParser': Missing a search command before '`'.

or from the GUI
|savedsearch testmacro
Error in 'SearchParser': Missing a search command before '`'.


Tags (3)

oliverquick
New Member

Did u ever get anywhere with the 'savedsearch' command within search.

I am having similar issues - no matter how I construct it I get

Error in 'savedsearch' command: Usage: [options]

I know the search exists as it appears after

./splunk help search-commands

0 Karma

mataharry
Communicator

I modified the file manually, I just can't find a way to make it work, or to find a way to call it.


./splunk search '| savedsearch testmacro '
./splunk search "| savedsearch testmacro "
./splunk search '| savedsearch "testmacro" '
Error in 'SearchParser': Missing a search command before '`'.

FYI : the GUI can't save a search with escaped characters like


index=_internal * earliest=-5d | `mymacro` | table now_time

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

seems like a bug to me. can you perhaps find and edit your case with the search string definition from the appropriate savedsearches.conf file? it's possible it's a GUI error and it could be worked around by editing the conf file directly.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...