Splunk Search

Macros not fetching data

sinhashubham014
Engager

I have a lookup which has fields like account_name, account_owner, environment etc. this lookup has more than 1000+ data. I created one macro under which write a search query below:

search [| inputlookup Account_Owners.csv |rename "Account ID" as aws_account_id |search Environment IN (PROD, UAT, ) |table account_id]

 

After that whenever, I am calling this macros with an index it's not fetching whole log except very accounts. But when I'm passing the lookup query directly into search with same index it's populating every logs 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I have a suspicion that you misspelled either account_id or aws_account_id in the macro because the way you presented, the resultant subsearch is NOT ().  Are you sure you copied the above search verbatim into index search and you get the correct result that is NOT the same as using the macro?

Further, which fieldname exists in actual data? aws_account_id or account_id?  For example, if account_id exists AND if you intend to match account_id in index data with "Account ID" in the lookup, your macro should be something like

search [inputlookup Account_Owners.csv |rename "Account ID" as account_id |search Environment IN (PROD, UAT, ) |table account_id]

Hope this helps.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...