Executing this search directly runs without issues. However when calling it using the savedsearch-command:
| savedsearch TestReport
I get the following error message:
Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'TestReport': Error while replacing variable name='test'. Could not find variable in the argument map.
I'm running Splunk 7.1.1 on a standalone machine. Does someone has a clue why it can be executed manually but not as a report and how I could execute it as a report?
Just had the very same problem and spent far too long trying to solve it. If you write test like this: $test$ then splunk interprets this as expecting an input variable of test. To resolve this it looks like you have to use double dollar signs: | makeresults count=1 | eval test="Hello" | map search="| makeresults count=1 | eval test=$$test$$"