If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?
If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?
If a nested macro expands to a search string that begins with a generating command, using a pipe character before the nested macro is necessary to incorporate the macro correctly into the search pipeline. This ensures proper syntax and execution of the search query.
There could be confusion between pipe and square brackets; just to be apparent, it is a pipe. sourcetype=access_* | `mymacro`
This question follows a best practice and it isn't true for all. But if the macro starts with a generating command (or any command) you have to put | before calling the macro Example: `macro` = stats count by something | `macro`