Using $starttime$ and $endtime$ in a macro with 'map'

[phemmer]

I am trying to create a macro which uses $startime$ and $endtime$ in a map. Whenever I do however I get the following error:

Error in 'map': Did not find value for required attribute 'starttime'.

Also this only happens if I specify a search time frame such as "Last 15 minutes". If I specify a custom time frame with specific beginning and end it works.

Here is the macro:

$search$ | localize timebefore=10s timeafter=10s | map search="search ( ($search$) OR ($filter$) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

The parameters are search and filter.

Additionally when I run the macro by hand, substituting the parameters, it works.

For example, this fails:

`surrounding("status>=500 status<=599", "error")`

But this works:

status>=500 status<=599 | localize timebefore=10s timeafter=10s | map search="search ( (status>=500 status<=599) OR (error) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

[sowings]

When I had to pass a field through to the map command like this (note: as part of saved search!), I had to double the dollar signs:


| inputlookup monitored_indexes.csv| fields index | dedup index | map maxsearches=99 search=" | db_inspect_collection($$index$$)"


Maybe doubling the dollar signs can help you?

[phemmer]

No joy, still gives the same error :-(. Thanks though.

[reed_kelly]

Unrelated, but that worked for me when adding a map command (with substitutions) to a dashboard. 🙂

[kml_uvce]

you are not passing $starttime$ and $endtime$ as arguments in macro call...

-Kamal Bisht

[phemmer]

You are correct, because they are not arguments. See documentation on map and localize.