Splunk Search

Need help in latest and earliest macro

srinivas_gowda
Path Finder

Hello all,

 

I am trying to add a earliest and latest macros in a saved search where the earliest is -7d@d and latest being @m . This saved search is scheduled to run once every week with timerange for last 7 days. When the scheduled search runs the data is not being updated from tier 1 to tier 3. However when the query is run manually it runs fine. 

 

Tested the same by removing the earliest and latest macros from the saved search and the scheduled run works just fine. The issue is in the latest and earliest macro values that is added. Can you please let me know what could be done for this to push data to the summary index.

 

Thank you.

Labels (4)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share how you are using these macros in your scheduled search? (Macros in splunk are usually for condensing chunks of SPL with the option of parameter substitution, but this doesn't sound like what you are using the term for.)

0 Karma

srinivas_gowda
Path Finder

Hello, I am using 2 macros one for earliest and the other for latest.

earliest=`Macro 1` latest=`Macro 2`

followed by the query

 

Macro 1 contains -7d@d

Macro 2 contains @m

 

We are using the macros as it is the standard for the project.

I hope this clarifies.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...