Splunk Search

Macro Argument not applying

ebs
Communicator

Hi.

I've created the following macro: sessionCount(1)

With this definition:

datamodel Test summariesonly=true search | search "TEST.date"=$date$ | stats count(exchangeId)

But when I enter this search: | `sessionCount(2021-05-18)` it doesn't work

But this search does: | datamodel Test summariesonly=true search | search "TEST.date"=2021-05-18 | stats count(exchangeId)

 

What am I doing wrong?

Labels (2)
0 Karma
1 Solution

aasabatini
Motivator

Hi @ebs 

check if the macro is public or private, also check all the permissions

Regards

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

0 Karma

aasabatini
Motivator

Hi @ebs 

check if the macro is public or private, also check all the permissions

Regards

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

ebs
Communicator

It seems it was a permissions issue, just took a while to propagate. Thank you!

0 Karma

ebs
Communicator

I fixed the permissions, but its still not working

0 Karma

aasabatini
Motivator

Hi @ebs 

Can you click on the searchand digit this sequence to expand the macro?

crtl+shift+e

New in 6.6, there is now a keystroke to expand macros in the search window! Click inside your search and press cmd-shift-E (on Mac, should be shift-WIN-E on Windows) and you'll see a window like this:

and please share the screen

Regards

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...