Splunk Search

What is the max search limit for a macro

xyz123
Explorer

Hello,

I have a macro that calls other macros in order to have a simple view of the code search.
The thing is that when running the macro I'm getting empty values, when I select the key combination control+shIft+e then select Open in New search I get all the results, I have only power user, how can I found out what's going on.

Thanks.

Tags (2)
0 Karma

tscroggins
Champion

@xyz123 

Can you provide an example of a nested macro that doesn't work as expected?

0 Karma

xyz123
Explorer

hello,
the code contains several macros and sub searches what I did was to take out the index=Linux for example out from the macro and now it works, not sure why this set up truncated the search.

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...