call a savedsearch calling a macro from the CLI

[mataharry]

I have a problem with that :

a macro that fills a new field
[mymacro]
definition = eval now_time=now() | convert ctime(now_time) timeformat="%d/%m/%Y %H:%M:%S"
iseval = 0

a saved search calling that macro
[testmacro]
is_visible = 1
search = index=_internal * earliest=-5d | `mymacro` |  table now_time

____
If i call the macro from the GUI, no problem
index=_internal * earliest=-5d | `mymacro` |  table now_time

If I call the macro from the CLI, no problem (after escaping the `)
./splunk search ' index=_internal * earliest=-5d | `mymacro` |  table now_time' 
or
./splunk search " index=_internal * earliest=-5d | \`mymacro\` |  table now_time" 

____

But if I call the savedsearch calling the macro , it's spreading error
from the CLI
./splunk search '| savedsearch testmacro '
Error in 'SearchParser': Missing a search command before '`'.

or from the GUI
|savedsearch testmacro
Error in 'SearchParser': Missing a search command before '`'.

[oliverquick]

Did u ever get anywhere with the 'savedsearch' command within search.

I am having similar issues - no matter how I construct it I get

Error in 'savedsearch' command: Usage: [options]

I know the search exists as it appears after

./splunk help search-commands

[mataharry]

I modified the file manually, I just can't find a way to make it work, or to find a way to call it.

./splunk search '| savedsearch testmacro '

./splunk search "| savedsearch testmacro "

./splunk search '| savedsearch "testmacro" '

Error in 'SearchParser': Missing a search command before '`'.

FYI : the GUI can't save a search with escaped characters like

index=_internal * earliest=-5d | `mymacro` |  table now_time

[gkanapathy]

seems like a bug to me. can you perhaps find and edit your case with the search string definition from the appropriate savedsearches.conf file? it's possible it's a GUI error and it could be worked around by editing the conf file directly.