I would like to be able to retrieve the name of the current search to pass to a macro in the search.
Saved Search name in app "Access - Cleartext Password At Rest"
| from datamodel:"Compute_Inventory"."Cleartext_Passwords"
| `get_info($SEARCH_NAME$)`
| stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(tag) as "tag",count by "dest","user","password"
Macro "get_info"
Argument: searchname
lookup searchparms $searchname$
So in this example when the scheduled search "Access - Cleartext Password At Rest" is run, it would lookup information from "searchparms" for "Access - Cleartext Password At Rest"
This link has a discussion around the problem.
Try $job.label$
@richgalloway I was unable to get any results for $job.label$