Reporting

call a savedsearch calling a macro from the CLI

Communicator

I have a problem with that :

a macro that fills a new field
[mymacro]
definition = eval now_time=now() | convert ctime(now_time) timeformat="%d/%m/%Y %H:%M:%S"
iseval = 0

a saved search calling that macro
[testmacro]
is_visible = 1
search = index=_internal * earliest=-5d | `mymacro` |  table now_time

____
If i call the macro from the GUI, no problem
index=_internal * earliest=-5d | `mymacro` |  table now_time

If I call the macro from the CLI, no problem (after escaping the `)
./splunk search ' index=_internal * earliest=-5d | `mymacro` |  table now_time' 
or
./splunk search " index=_internal * earliest=-5d | \`mymacro\` |  table now_time" 

____

But if I call the savedsearch calling the macro , it's spreading error
from the CLI
./splunk search '| savedsearch testmacro '
Error in 'SearchParser': Missing a search command before '`'.

or from the GUI
|savedsearch testmacro
Error in 'SearchParser': Missing a search command before '`'.


Tags (3)

New Member

Did u ever get anywhere with the 'savedsearch' command within search.

I am having similar issues - no matter how I construct it I get

Error in 'savedsearch' command: Usage: [options]

I know the search exists as it appears after

./splunk help search-commands

0 Karma

Communicator

I modified the file manually, I just can't find a way to make it work, or to find a way to call it.


./splunk search '| savedsearch testmacro '
./splunk search "| savedsearch testmacro "
./splunk search '| savedsearch "testmacro" '
Error in 'SearchParser': Missing a search command before '`'.

FYI : the GUI can't save a search with escaped characters like


index=_internal * earliest=-5d | `mymacro` | table now_time

0 Karma

Splunk Employee
Splunk Employee

seems like a bug to me. can you perhaps find and edit your case with the search string definition from the appropriate savedsearches.conf file? it's possible it's a GUI error and it could be worked around by editing the conf file directly.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!