Splunk Search

Using $starttime$ and $endtime$ in a macro with 'map'

phemmer
Path Finder

I am trying to create a macro which uses $startime$ and $endtime$ in a map. Whenever I do however I get the following error:

Error in 'map': Did not find value for required attribute 'starttime'.

Also this only happens if I specify a search time frame such as "Last 15 minutes". If I specify a custom time frame with specific beginning and end it works.

Here is the macro:

$search$ | localize timebefore=10s timeafter=10s | map search="search ( ($search$) OR ($filter$) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

The parameters are search and filter.

Additionally when I run the macro by hand, substituting the parameters, it works.

For example, this fails:

`surrounding("status>=500 status<=599", "error")`

But this works:

status>=500 status<=599 | localize timebefore=10s timeafter=10s | map search="search ( (status>=500 status<=599) OR (error) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s
Tags (3)

sowings
Splunk Employee
Splunk Employee

When I had to pass a field through to the map command like this (note: as part of saved search!), I had to double the dollar signs:


| inputlookup monitored_indexes.csv| fields index | dedup index | map maxsearches=99 search=" | db_inspect_collection($$index$$)"

Maybe doubling the dollar signs can help you?

phemmer
Path Finder

No joy, still gives the same error :-(. Thanks though.

0 Karma

reed_kelly
Contributor

Unrelated, but that worked for me when adding a map command (with substitutions) to a dashboard. 🙂

0 Karma

kml_uvce
Builder

you are not passing $starttime$ and $endtime$ as arguments in macro call...

-Kamal Bisht

0 Karma

phemmer
Path Finder

You are correct, because they are not arguments. See documentation on map and localize.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...