Why do I need a | when using a macro with a generating command?

[cvg1wby]

I have a macro that starts with a search command.  When I ran it, I noticed I was getting a different number of results than if I just ran the raw SPL vs using the macro.

As an example my macro was named open_vulnerabilities and the SPL was:

search index="vulnerabilities" severity_id>=2 state!="fixed"

If I use the macro in the search bar like this:

`open_vulnerabilities`

I would get say 10 results.  But if I ran the full SPL (index="vulnerabilities"...) then I'd get 100 results.

I ended up figuring out that if I used a | before the macro name, like this

| `open_vulnerabilities`

 then I'd get the number of results I expected.  I just don't understand why. 

If I got 0 results, then it would make some sense but the fact that it's returning 10 really has me stumped.  Any help would be greatly appreciated.  Thanks

[richgalloway · Accepted solution]

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

[cvg1wby]

Thanks.  I haven't used that before and it was pretty helpful.   Turns out the extra search was the problem.  It was doing this under the hood

| (search index="vulnerabilities" severity_id>=2 state!="fixed") search