Using Macro in savedsearches.conf

[freephoneid]

Hi,

I've following entry in my savedsearches.conf:

[My_Summary_Query]
action.email.inline = 1
action.email.reportServerEnabled = 0
action.summary_index = 1
action.summary_index._name = `MY_SUMMARY_MACRO`
alert.suppress = 0
alert.track = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -1h@h
dispatch.latest_time = @h
enableSched = 1
realtime_schedule = 0
search = `MY_MACRO` sourcetype="my_log" | <my query here...> 
vsid = *:fjdfnv5

The above code works fine & dashboard is displayed fine too. but then in Manager->Searches & Reports, if I click on the above query, it shows MY_SUMMARY_MACRO in the "Select the summary index" drop-down under "Summary Indexing" section.

And it starts displaying warning above, if I save anything....

Is this an issue in splunk?

Thanks!

[gkanapathy · Accepted solution]

No, you can't run a macro there. The only place macros are expanded in when search strings are evaluated.

[tonopahtaos]

I did some testing on this. This answer is right. What i did is:

Add following into macro.conf:

[Time_Range_To_Get_Stats_From_All]
definition = -3d

Add following into savedsearch.conf:

dispatch.earliest_time = Time_Range_To_Get_Stats_From_All

This should be equal to put following line to savedsearch.conf file:

dispatch.earliest_time = -3d

But the result is not. The scheduled saved search is running. But not for 3 days data. Instead, it is for all data in the system. I got this from S.o.S. It seems Splunk will use wrong date range if it finds the format is incorrect.

[freephoneid]

The reason I added macro is because we've different environments, say alpha, & when I want to deploy in Alpha, I'll simply change the macro to use just different index name...My macro contains only index definition...How would there be an issue exactly, can you explain?

[gkanapathy]

there is some harm, if only in extra server resources and space being consumed. can you please explain why you have summary indexing enabled, and what you think entering a macro there will do for you?

[freephoneid]

But there is no harm in putting these macros as shown above, right?