Splunk Search

Need help in latest and earliest macro

srinivas_gowda
Path Finder

Hello all,

 

I am trying to add a earliest and latest macros in a saved search where the earliest is -7d@d and latest being @m . This saved search is scheduled to run once every week with timerange for last 7 days. When the scheduled search runs the data is not being updated from tier 1 to tier 3. However when the query is run manually it runs fine. 

 

Tested the same by removing the earliest and latest macros from the saved search and the scheduled run works just fine. The issue is in the latest and earliest macro values that is added. Can you please let me know what could be done for this to push data to the summary index.

 

Thank you.

Labels (4)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share how you are using these macros in your scheduled search? (Macros in splunk are usually for condensing chunks of SPL with the option of parameter substitution, but this doesn't sound like what you are using the term for.)

0 Karma

srinivas_gowda
Path Finder

Hello, I am using 2 macros one for earliest and the other for latest.

earliest=`Macro 1` latest=`Macro 2`

followed by the query

 

Macro 1 contains -7d@d

Macro 2 contains @m

 

We are using the macros as it is the standard for the project.

I hope this clarifies.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!