Splunk Search

Using $starttime$ and $endtime$ in a macro with 'map'

phemmer
Path Finder

I am trying to create a macro which uses $startime$ and $endtime$ in a map. Whenever I do however I get the following error:

Error in 'map': Did not find value for required attribute 'starttime'.

Also this only happens if I specify a search time frame such as "Last 15 minutes". If I specify a custom time frame with specific beginning and end it works.

Here is the macro:

$search$ | localize timebefore=10s timeafter=10s | map search="search ( ($search$) OR ($filter$) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

The parameters are search and filter.

Additionally when I run the macro by hand, substituting the parameters, it works.

For example, this fails:

`surrounding("status>=500 status<=599", "error")`

But this works:

status>=500 status<=599 | localize timebefore=10s timeafter=10s | map search="search ( (status>=500 status<=599) OR (error) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s
Tags (3)

sowings
Splunk Employee
Splunk Employee

When I had to pass a field through to the map command like this (note: as part of saved search!), I had to double the dollar signs:


| inputlookup monitored_indexes.csv| fields index | dedup index | map maxsearches=99 search=" | db_inspect_collection($$index$$)"

Maybe doubling the dollar signs can help you?

phemmer
Path Finder

No joy, still gives the same error :-(. Thanks though.

0 Karma

reed_kelly
Contributor

Unrelated, but that worked for me when adding a map command (with substitutions) to a dashboard. 🙂

0 Karma

kml_uvce
Builder

you are not passing $starttime$ and $endtime$ as arguments in macro call...

-Kamal Bisht

0 Karma

phemmer
Path Finder

You are correct, because they are not arguments. See documentation on map and localize.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.