My macro looks like this [|makeresults count=0] | append [ search `mymacro` | rex --- | rex --- | rex --- | eval -- | eval --- | fields _time, -,-] | lookup --- | lookup --- | lookup --- | search --- ---------------------------------- I'm building a scheduled alert which runs this macro using earliest and latest time period earliest="04/11/2025:12:10:01" latest="04/11/2025:12:20:01" `mymacro` | table _time IP So this time range is not passing within above macro subquery which is nested. Hope this give you more info.
... View more
