Splunk Search
Highlighted

Using $starttime$ and $endtime$ in a macro with 'map'

Path Finder

I am trying to create a macro which uses $startime$ and $endtime$ in a map. Whenever I do however I get the following error:

Error in 'map': Did not find value for required attribute 'starttime'.

Also this only happens if I specify a search time frame such as "Last 15 minutes". If I specify a custom time frame with specific beginning and end it works.

Here is the macro:

$search$ | localize timebefore=10s timeafter=10s | map search="search ( ($search$) OR ($filter$) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

The parameters are search and filter.

Additionally when I run the macro by hand, substituting the parameters, it works.

For example, this fails:

`surrounding("status>=500 status<=599", "error")`

But this works:

status>=500 status<=599 | localize timebefore=10s timeafter=10s | map search="search ( (status>=500 status<=599) OR (error) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s
Tags (3)
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Builder

you are not passing $starttime$ and $endtime$ as arguments in macro call...

-Kamal Bisht

0 Karma
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Path Finder

You are correct, because they are not arguments. See documentation on map and localize.

0 Karma
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Champion

When I had to pass a field through to the map command like this (note: as part of saved search!), I had to double the dollar signs:


| inputlookup monitoredindexes.csv| fields index | dedup index | map maxsearches=99 search=" | `dbinspect_collection($$index$$)`"

Maybe doubling the dollar signs can help you?

Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Path Finder

No joy, still gives the same error :-(. Thanks though.

0 Karma
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Contributor

Unrelated, but that worked for me when adding a map command (with substitutions) to a dashboard. 🙂

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.