Splunk Search

Macro with tsats query returns no results.

jscraig2006
Communicator

I've created several macros with a tstat query. when running the macro through the UI, no results are displayed. When I run the tstat through the UI, i get results. I do not have a pipe in front of the query in the macro. Permissions are set to Global for the macro. My Splunk infrastructure is distributed with clustered search peers. Is it possible that the macros are not being expanded and the bundles are not being replicated to the peers?

0 Karma
1 Solution

jscraig2006
Communicator

I always seem to answer my own questions. since macro tstat commands do not start with a | i needed to add it before the macro name in the UI. | macro_name.

View solution in original post

0 Karma

jscraig2006
Communicator

I always seem to answer my own questions. since macro tstat commands do not start with a | i needed to add it before the macro name in the UI. | macro_name.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...