I am trying to add a earliest and latest macros in a saved search where the earliest is -7d@d and latest being @m . This saved search is scheduled to run once every week with timerange for last 7 days. When the scheduled search runs the data is not being updated from tier 1 to tier 3. However when the query is run manually it runs fine.
Tested the same by removing the earliest and latest macros from the saved search and the scheduled run works just fine. The issue is in the latest and earliest macro values that is added. Can you please let me know what could be done for this to push data to the summary index.
Can you share how you are using these macros in your scheduled search? (Macros in splunk are usually for condensing chunks of SPL with the option of parameter substitution, but this doesn't sound like what you are using the term for.)