https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-have-optional-arguments-in-search-macros/m-p/168628#M1593 <P>I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:</P> <PRE><CODE>`my_top(1)` --&gt; `my_top($field$, 20)` `my_top(2)` --&gt; stats count by $field$ | sort - count | head $num$ </CODE></PRE> <P>The user of the macro can choose to define the optional <CODE>num</CODE> argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.</P> Wed, 29 Apr 2015 15:28:20 GMT martin_mueller 2015-04-29T15:28:20Z https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-have-optional-arguments-in-search-macros/m-p/168627#M1592 <P>Hello,</P> <P>I'm reading about search macros, and I was wondering if there was a way to have optional arguments? From what I've read, the definitions of arguments is an absolute number ( e.g. foo(#) ). The most obvious solution would be to make a macro with the same name with 1, 2, 3, 4, etc arguments for the expected combinations of optional arguments.</P> <P>Maybe defining the number of arguments to be an impossibly large number and formulate the search such that it works with null fields?</P> <P>I don't have a concrete example, but something that comes to mind could be a complex or bulky search that could take any number of fields. Just trying to figure out what I can and can't do with macros.</P> <P>Thanks!</P> Wed, 29 Apr 2015 14:08:30 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-have-optional-arguments-in-search-macros/m-p/168627#M1592 j4adam 2015-04-29T14:08:30Z https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-have-optional-arguments-in-search-macros/m-p/168628#M1593 <P>I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:</P> <PRE><CODE>`my_top(1)` --&gt; `my_top($field$, 20)` `my_top(2)` --&gt; stats count by $field$ | sort - count | head $num$ </CODE></PRE> <P>The user of the macro can choose to define the optional <CODE>num</CODE> argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.</P> Wed, 29 Apr 2015 15:28:20 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-have-optional-arguments-in-search-macros/m-p/168628#M1593 martin_mueller 2015-04-29T15:28:20Z