Splunk Search

Error when using a Datamodel in a Macro

ebs
Communicator

Hi,

I'm using the following datamodel search:

| datamodel Test_Ping_Access summariesonly=true search | search "Ping_Access__TEST.date"=$date$ | stats count(exchangeId)

And I've confirmed its working, but when I use it in a macro I get this error:

Error in 'SearchParser': The datamodel command can only be used as the first command on a search

How can I resolve this?

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

When creating a macro that uses a generating command, such as datamodel or inputlookup, you need to leave the | symbol out of the macro definition, so your macro will just be

datamodel Test_Ping_Access summariesonly=true search | search "Ping_Access__TEST.date"=$date$ | stats count(exchangeId)

and then you use it like this

| `my_datamodel_macro(date)`

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

When creating a macro that uses a generating command, such as datamodel or inputlookup, you need to leave the | symbol out of the macro definition, so your macro will just be

datamodel Test_Ping_Access summariesonly=true search | search "Ping_Access__TEST.date"=$date$ | stats count(exchangeId)

and then you use it like this

| `my_datamodel_macro(date)`

ebs
Communicator

Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...