Splunk search

[LogUx]

Hello Splunkers !!

I am getting below while executing the search . Please let me know why this error occurs and help me fix the issue.

uagraw01_0-1702888966178.png

[bowesmana]

Your `indextime` is a macro and it's expansion does not work with the >=$info_min_time$

Other points:

The documentation says that map does not work after appendpipe or append commands - see Known limitations

https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/map

Your use of appendpipe in this example is odd in that it does nothing - I assume this is from some more complete search

This search is probably NOT the way you want to do what you are trying to do - given your maxsearch=20000, this may take forever to run if you really have that many searches to run sequentially.

Perhaps you can say what you're trying to achieve as map seems as though it may not be the solution for your scenario.

[splunkreal]

Hello @LogUx  what is `indextime`for you, is that macro? If yes try replacing by the content of the macro directly.