Splunk Search

Using Macro in savedsearches.conf

freephoneid
Path Finder

Hi,

I've following entry in my savedsearches.conf:

[My_Summary_Query]
action.email.inline = 1
action.email.reportServerEnabled = 0
action.summary_index = 1
action.summary_index._name = `MY_SUMMARY_MACRO`
alert.suppress = 0
alert.track = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -1h@h
dispatch.latest_time = @h
enableSched = 1
realtime_schedule = 0
search = `MY_MACRO` sourcetype="my_log" | <my query here...> 
vsid = *:fjdfnv5

The above code works fine & dashboard is displayed fine too. but then in Manager->Searches & Reports, if I click on the above query, it shows MY_SUMMARY_MACRO in the "Select the summary index" drop-down under "Summary Indexing" section.

And it starts displaying warning above, if I save anything....

Is this an issue in splunk?

Thanks!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No, you can't run a macro there. The only place macros are expanded in when search strings are evaluated.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

No, you can't run a macro there. The only place macros are expanded in when search strings are evaluated.

View solution in original post

tonopahtaos
Path Finder

I did some testing on this. This answer is right. What i did is:

Add following into macro.conf:

[Time_Range_To_Get_Stats_From_All]
definition = -3d

Add following into savedsearch.conf:

dispatch.earliest_time = Time_Range_To_Get_Stats_From_All

This should be equal to put following line to savedsearch.conf file:

dispatch.earliest_time = -3d

But the result is not. The scheduled saved search is running. But not for 3 days data. Instead, it is for all data in the system. I got this from S.o.S. It seems Splunk will use wrong date range if it finds the format is incorrect.

0 Karma

freephoneid
Path Finder

The reason I added macro is because we've different environments, say alpha, & when I want to deploy in Alpha, I'll simply change the macro to use just different index name...My macro contains only index definition...How would there be an issue exactly, can you explain?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

there is some harm, if only in extra server resources and space being consumed. can you please explain why you have summary indexing enabled, and what you think entering a macro there will do for you?

0 Karma

freephoneid
Path Finder

But there is no harm in putting these macros as shown above, right?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!