Splunk Search
Highlighted

Using $starttime$ and $endtime$ in a macro with 'map'

Path Finder

I am trying to create a macro which uses $startime$ and $endtime$ in a map. Whenever I do however I get the following error:

Error in 'map': Did not find value for required attribute 'starttime'.

Also this only happens if I specify a search time frame such as "Last 15 minutes". If I specify a custom time frame with specific beginning and end it works.

Here is the macro:

$search$ | localize timebefore=10s timeafter=10s | map search="search ( ($search$) OR ($filter$) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s

The parameters are search and filter.

Additionally when I run the macro by hand, substituting the parameters, it works.

For example, this fails:

`surrounding("status>=500 status<=599", "error")`

But this works:

status>=500 status<=599 | localize timebefore=10s timeafter=10s | map search="search ( (status>=500 status<=599) OR (error) ) starttimeu=$starttime$ endtimeu=$endtime$" | eval _raw=strftime(_time, "%T")." - "._raw | transaction maxpause=10s
Tags (3)
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Builder

you are not passing $starttime$ and $endtime$ as arguments in macro call...

-Kamal Bisht

0 Karma
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Path Finder

You are correct, because they are not arguments. See documentation on map and localize.

0 Karma
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Champion

When I had to pass a field through to the map command like this (note: as part of saved search!), I had to double the dollar signs:


| inputlookup monitoredindexes.csv| fields index | dedup index | map maxsearches=99 search=" | `dbinspect_collection($$index$$)`"

Maybe doubling the dollar signs can help you?

Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Path Finder

No joy, still gives the same error :-(. Thanks though.

0 Karma
Highlighted

Re: Using $starttime$ and $endtime$ in a macro with 'map'

Contributor

Unrelated, but that worked for me when adding a map command (with substitutions) to a dashboard. 🙂

0 Karma