Hi all,   I have created a custom search command that need some preformated input. To do so, I always run my command with the same splunk commands before : ... | eval a=b+c | stats count by a | bin ... | my_custom_command(count,a,b,c) Hence, i have created a macro to wrap all this code, so I only have to call my macro : ... | `my_macro(b,c)` The problem is because it is a macro, it does not have the description of the searchbnf.conf for "my_custom_command".   So I would like to edit the code of "my_custom_command" to "embed" the splunk commands i always run  (the stats, bin, eval connands) before running my own code. Is there a way to do so ? If no, is there a way to create a searchbnf for a macro ? ... View more

Hello, I created a specific role for some users with a defined maximum time window. Hence, these users are not allowed to search for more tha 7 days. As specified in the docs, srchTimeWin = <integer> * Maximum time span, in seconds, of a search. * This time window limit is applied backwards from the latest time specified in a search. The problem is that when time window specified in the search is greater than the maximum time window, there are no messages that can warn the user that his search time window has been reduced. Is there a way to display an error or a message when this happens ? ... View more