If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?
If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?
If a nested macro expands to a search string that begins with a generating command, using a pipe character before the nested macro is necessary to incorporate the macro correctly into the search pipeline. This ensures proper syntax and execution of the search query.
This question follows a best practice and it isn't true for all. But if the macro starts with a generating command (or any command) you have to put | before calling the macro Example: `macro` = stats count by something | `macro`
There could be confusion between pipe and square brackets; just to be apparent, it is a pipe. sourcetype=access_* | `mymacro`