If I create a simple macro called 'test' defined as
* | head 1 | eval text="boo" | fields text
Then run a search using map :
* | head 5 | map search="search `test`" | table text
I would expect to see 5 lines with text="boo"
What I actually see is a warning that reads :
Unable to run query '`test`'.
Is there a limitation in map when it comes to macro expansion ?
Should not. It's a bug. SPL-66265 was created.
Workaround:
Promote the macro from the user to the app level = Change the macro permissions from Private to app or all apps.
Should not. It's a bug. SPL-66265 was created.
Workaround:
Promote the macro from the user to the app level = Change the macro permissions from Private to app or all apps.