Retrieve the name of the current search

[Scott_Kudelski]

I would like to be able to retrieve the name of the current search to pass to a macro in the search.

Saved Search name in app "Access - Cleartext Password At Rest"

| from datamodel:"Compute_Inventory"."Cleartext_Passwords"
| `get_info($SEARCH_NAME$)`
| stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(tag) as "tag",count by "dest","user","password"

Macro "get_info"
Argument: searchname
lookup searchparms $searchname$

So in this example when the scheduled search "Access - Cleartext Password At Rest" is run, it would lookup information from "searchparms" for "Access - Cleartext Password At Rest"

[bowesmana]

This link has a discussion around the problem. 

https://community.splunk.com/t5/Reporting/Any-way-to-get-the-name-of-the-scheduled-search-you-are-in...

[richgalloway]

Try $job.label$

[Scott_Kudelski]

@richgalloway I was unable to get any results for $job.label$