hey guys, i'm stuck with this macro problem, where i cannot run a savedsearch with a macro inside it. 1. i have a savedsearch like this: .... | eval param1="777" | `myMacro("$param1$")` 2. myMacro is configured like this: eval mySqlQuery="select * from myTable where someField like ".$param1$." and otherField=='abc' " 3. i doesn't work. main error i face is this: Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'mySavedSearch': Error while replacing variable name='param1'. Could not find variable in the argument map.. The closest info i've found is this (which works perfectly in the shown example, but not in my case - and i don't understand why): https://community.splunk.com/t5/Knowledge-Management/How-do-I-make-macro-arguments-get-parsed-as-fields-instead-of/m-p/416938   i mean, i tried many options with macro and savedsearch configuration (with $-s and "-s), unsuccessfully so far. P.S. maybe this is important: i try to run a savedsearch, and the guys in the link above just run a search (which i tried as well - and it's OK). anyway, i don't know how to fix my savedsearch scenario... ... View more

Hey guys, could you please help and clarify this paragraph from the docs: https://docs.splunk.com/Documentation/Splunk/8.1.1/Installation/MigrateaSplunkinstance “When you copy individual bucket files, you must make sure that no bucket IDs conflict on the new system. Otherwise, Splunk Enterprise does not start. “ I’m not quite sure how this can happen? ... View more