Need help in latest and earliest macro

[srinivas_gowda]

Hello all,

I am trying to add a earliest and latest macros in a saved search where the earliest is -7d@d and latest being @m . This saved search is scheduled to run once every week with timerange for last 7 days. When the scheduled search runs the data is not being updated from tier 1 to tier 3. However when the query is run manually it runs fine. 

Tested the same by removing the earliest and latest macros from the saved search and the scheduled run works just fine. The issue is in the latest and earliest macro values that is added. Can you please let me know what could be done for this to push data to the summary index.

Thank you.

[ITWhisperer]

Can you share how you are using these macros in your scheduled search? (Macros in splunk are usually for condensing chunks of SPL with the option of parameter substitution, but this doesn't sound like what you are using the term for.)

[srinivas_gowda]

Hello, I am using 2 macros one for earliest and the other for latest.

earliest=`Macro 1` latest=`Macro 2`

followed by the query

Macro 1 contains -7d@d

Macro 2 contains @m

We are using the macros as it is the standard for the project.

I hope this clarifies.