Reporting
Highlighted

call a savedsearch calling a macro from the CLI

Communicator

I have a problem with that :

a macro that fills a new field
[mymacro]
definition = eval now_time=now() | convert ctime(now_time) timeformat="%d/%m/%Y %H:%M:%S"
iseval = 0

a saved search calling that macro
[testmacro]
is_visible = 1
search = index=_internal * earliest=-5d | `mymacro` |  table now_time

____
If i call the macro from the GUI, no problem
index=_internal * earliest=-5d | `mymacro` |  table now_time

If I call the macro from the CLI, no problem (after escaping the `)
./splunk search ' index=_internal * earliest=-5d | `mymacro` |  table now_time' 
or
./splunk search " index=_internal * earliest=-5d | \`mymacro\` |  table now_time" 

____

But if I call the savedsearch calling the macro , it's spreading error
from the CLI
./splunk search '| savedsearch testmacro '
Error in 'SearchParser': Missing a search command before '`'.

or from the GUI
|savedsearch testmacro
Error in 'SearchParser': Missing a search command before '`'.


Tags (3)
Highlighted

Re: call a savedsearch calling a macro from the CLI

Legend

seems like a bug to me. can you perhaps find and edit your case with the search string definition from the appropriate savedsearches.conf file? it's possible it's a GUI error and it could be worked around by editing the conf file directly.

0 Karma
Highlighted

Re: call a savedsearch calling a macro from the CLI

Communicator

I modified the file manually, I just can't find a way to make it work, or to find a way to call it.


./splunk search '| savedsearch testmacro '
./splunk search "| savedsearch testmacro "
./splunk search '| savedsearch "testmacro" '
Error in 'SearchParser': Missing a search command before '`'.

FYI : the GUI can't save a search with escaped characters like


index=internal * earliest=-5d | `mymacro` | table nowtime

0 Karma
Highlighted

Re: call a savedsearch calling a macro from the CLI

New Member

Did u ever get anywhere with the 'savedsearch' command within search.

I am having similar issues - no matter how I construct it I get

Error in 'savedsearch' command: Usage: [options]

I know the search exists as it appears after

./splunk help search-commands

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.