I have a problem with that :
a macro that fills a new field [mymacro] definition = eval now_time=now() | convert ctime(now_time) timeformat="%d/%m/%Y %H:%M:%S" iseval = 0 a saved search calling that macro [testmacro] is_visible = 1 search = index=_internal * earliest=-5d | `mymacro` | table now_time ____ If i call the macro from the GUI, no problem index=_internal * earliest=-5d | `mymacro` | table now_time If I call the macro from the CLI, no problem (after escaping the `) ./splunk search ' index=_internal * earliest=-5d | `mymacro` | table now_time' or ./splunk search " index=_internal * earliest=-5d | \`mymacro\` | table now_time" ____ But if I call the savedsearch calling the macro , it's spreading error from the CLI ./splunk search '| savedsearch testmacro ' Error in 'SearchParser': Missing a search command before '`'. or from the GUI |savedsearch testmacro Error in 'SearchParser': Missing a search command before '`'.
Did u ever get anywhere with the 'savedsearch' command within search.
I am having similar issues - no matter how I construct it I get
Error in 'savedsearch' command: Usage:
I know the search exists as it appears after
./splunk help search-commands
I modified the file manually, I just can't find a way to make it work, or to find a way to call it.
./splunk search '| savedsearch testmacro '
./splunk search "| savedsearch testmacro "
./splunk search '| savedsearch "testmacro" '
Error in 'SearchParser': Missing a search command before '`'.
FYI : the GUI can't save a search with escaped characters like
index=_internal * earliest=-5d | `mymacro` | table now_time
seems like a bug to me. can you perhaps find and edit your case with the search string definition from the appropriate savedsearches.conf file? it's possible it's a GUI error and it could be worked around by editing the conf file directly.