topic Is it possible to pass an event field as an argument to a macro? in Knowledge Management

Is it possible to pass an event field as an argument to a macro?

mnm1987 — Thu, 12 Jan 2017 20:43:39 GMT

Hello Fellow Splunkers,
This is a question about Macros in Splunk. I was wondering if its even possible to pass field name from Events as arguments to your macro.

For eg: If I have a macro configured to getInfo(info_id,info_time), info_id and info_time would be event fields from an index.
something like index=infologs |getinfo(info_id,info_time)

Thanks.
Mukund

Re: Is it possible to pass an event field as an argument to a macro?

gokadroid — Thu, 12 Jan 2017 23:07:11 GMT

Yes you can. Have a look here as an example which uses revenue field being passed with another rate value which then get multiplied inside the macro.

Example in its simplest terms:

GoTo Settings»  Advanced search » Search macros » Add new

Update in the sections Name, Definition and Argument respectively as multiplyABC(3), eval dd=$a$*$b$*$c$, a,b,c
Call it as follows:

`multiplyABC(field1,field2,field3)`

Re: Is it possible to pass an event field as an argument to a macro?

mnm1987 — Tue, 29 Sep 2020 12:27:29 GMT

gokadroid - Thanks for the response, I understand that the above steps are handy when creating a macro with Arguments.

But my requirement was to be able to specify or call the macro in the following way
index="blah" |multiplyABC(field1,field2,field3)
where field1,field2 and field3 are not explicitly hardcoded values, instead they are Fields in the events found for index="blah".

Based on my observation, passing event fields get treated literally instead of interpreting their values, i.e.
the expanded macro search would look as follows

eval dd=field1*field2*field3