I want to pass a variable to a savedsearch using this method:
| savedsearch mySavedSearch1 inputParam1="value1"
Within "mySavedSearch1" I have a macro where I want to use the value of inputParam1:
|`myMacro1($inputParam1$)`
"myMacro1" contains the following
| tstats count where `indexes_$inputParam1$` by host
When I try to save mySavedSearch1 I get the following error:
Error in 'SearchParser': The name
'indexes_$inputParam1$' is invalid. Macro
and argument names may only include
alphanumerics, '_' and '-'.
The example is highly stripped and myMacro1 contains much more. The reason behind this setup is to be able to reuse myMacro1 both in reports and dashboards.
To me it seems like I am not able to turn the input parameter "inputParam1" into a value in mySavedSearch1.
Anyone who can help me out?
... View more