Splunk Search

tstats in macro without pipe

realsplunk
Motivator

Hello,

is it normal that tstats must be without pipe | to run in a macro?

The macro is scheduled.

Thanks.

0 Karma
1 Solution

elliotproebstel
Champion

It is normal (expected behavior) that a macro cannot start with a pipe, regardless of whether it's used in a scheduled search or an ad-hoc search.

View solution in original post

elliotproebstel
Champion

It is normal (expected behavior) that a macro cannot start with a pipe, regardless of whether it's used in a scheduled search or an ad-hoc search.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.