splunk trending...

[DTERM]

I'm trying to integrate information from this link http://splunk-base.splunk.com/answers/13482/plotting-trendlines-into-the-future into my search and am having a few issues.

I've created the lineartrend(2) and extrendtrend(2) as suggested by the link above. Now I'd like to pass those macros into a search utilizing an index, not syslog. That being said, when I run the following query

index=myapp |timechart count
| lineartrend(_time, count)
| extendtrend(newY, 7)
| eval low_threshold=5000
| eval high_threshold=50000
| timechart values(count) as events values(newY) as linear_trend values(low_threshold) as low_threshold values(high_threshold) as high_threshold

The error I get is a the following:

Search operation 'args; is unknown. You might not have permission to run this operation.

Now I'm running this as admin, so the latter part of the error is not accurate at all.

Why is the search complaining about 'args'? What am I missing?

TIA

[Paolo_Prigione · Accepted solution]

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold

[DTERM]

The macros were copied and pasted directly from the link. Unless there is a typo in the posted macros, I don't think that is true.

What is a good test to see if the macros work stand alone? My test is just piping the entire index into the macro. Is there a better test?

[lguinn2]

My guess is that you have a typo in your macros.conf file, but there is no way to tell from here...