Metadata token inside macro

akai — Tue, 28 Apr 2026 06:58:49 GMT

Hello,

I have a requirement where I need to have the name of the current running saved search available to itself. And to avoid human error, I am looking for an automated way of doing this.

Based on this question, I can use | eval search_name="$name$" and it works fine, but I was looking into a way of putting that inside a macro. Unfortunately, when doing that, search_name ends up with the literal value "$name$".

Is anyone doing something similar and has a solution?

Thank you

Re: Metadata token inside macro

VatsalJagani — Fri, 08 May 2026 05:59:13 GMT

Hello @akai ,

The issue is $name$ inside the macro is no longer a token its more of a macro parameter.

In order to fix you need to pass $name$ as a macro argument from the saved search itself.

Define your macro to accept the search name as an argument — e.g., my_macro(1) with argument search_name. And macro definition would be something like this:

[my_macro(1)] args = search_name definition = eval search_name=$search_name|s$

Then you can call the macro like this:

..... | `my_macro($name$)` | table search_name

I hope this helps!!!

topic Metadata token inside macro in Splunk Enterprise

Metadata token inside macro

Re: Metadata token inside macro