<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How can I create a Macro with multiple arguments? in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/How-can-I-create-a-Macro-with-multiple-arguments/m-p/283015#M2488</link>
    <description>&lt;P&gt;Sure, if you are just passing text values, all destined for testing a single field, then you can pass the argument as a single delimited string, and parse it in the macro.  Can't write the parse code off the top of my head, but the call would look like - &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; get_type("value_1, value_2, value_3")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Or, you could pass the arguments as an already-configured string like &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;get_type("my_field=value_1 OR my_field=value_2 OR my_field=value_3")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and just invoke the argument as &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where $arg1$
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;It seems to me the first method gives a better abstraction barrier, but the second one should work just as well.&lt;/P&gt;</description>
    <pubDate>Thu, 09 Feb 2017 15:34:52 GMT</pubDate>
    <dc:creator>DalJeanis</dc:creator>
    <dc:date>2017-02-09T15:34:52Z</dc:date>
    <item>
      <title>How can I create a Macro with multiple arguments?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/How-can-I-create-a-Macro-with-multiple-arguments/m-p/283014#M2487</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;I want to create a macro with at least 1 argument and maximum 20 arguments.&lt;BR /&gt;
So I created 20 macros. (See example below. I only displayed 3 of them and leaved out some other statements.)&lt;/P&gt;

&lt;P&gt;Is there a other way to do this?&lt;/P&gt;

&lt;P&gt;Example of my current macros.conf file: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; [get_type(3)]
 args = field_1, field_2, field_3
 definition = ... | where (my_field=$field_1$ OR my_field=$field_2$ OR my_field=$field_3$) | ...

 [get_type(2)]
 args = field_1, field_2
 definition = ... | where (my_field=$field_1$ OR my_field=$field_2$) | ...

 [get_type(1)]
 args = field_1
 definition = ...| where my_field=$field_1$ | ...
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 09 Feb 2017 07:29:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/How-can-I-create-a-Macro-with-multiple-arguments/m-p/283014#M2487</guid>
      <dc:creator>raymondc</dc:creator>
      <dc:date>2017-02-09T07:29:14Z</dc:date>
    </item>
    <item>
      <title>Re: How can I create a Macro with multiple arguments?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/How-can-I-create-a-Macro-with-multiple-arguments/m-p/283015#M2488</link>
      <description>&lt;P&gt;Sure, if you are just passing text values, all destined for testing a single field, then you can pass the argument as a single delimited string, and parse it in the macro.  Can't write the parse code off the top of my head, but the call would look like - &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; get_type("value_1, value_2, value_3")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Or, you could pass the arguments as an already-configured string like &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;get_type("my_field=value_1 OR my_field=value_2 OR my_field=value_3")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and just invoke the argument as &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where $arg1$
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;It seems to me the first method gives a better abstraction barrier, but the second one should work just as well.&lt;/P&gt;</description>
      <pubDate>Thu, 09 Feb 2017 15:34:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/How-can-I-create-a-Macro-with-multiple-arguments/m-p/283015#M2488</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2017-02-09T15:34:52Z</dc:date>
    </item>
  </channel>
</rss>

