<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Macro Arguments in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42732#M391</link>
    <description>&lt;P&gt;I'm totally lost when it comes to arguments in macros. Here is what I want to do. I have three partial searches that are almost identical. &lt;/P&gt;

&lt;P&gt;sourcetype="iis" cs_username!="-" /TM/ .pdf&lt;/P&gt;

&lt;P&gt;sourcetype="iis" cs_username!="-" /TD/ .pdf&lt;/P&gt;

&lt;P&gt;sourcetype="iis" cs_username!="-" /TDB/ .pdf&lt;/P&gt;

&lt;P&gt;I would like to turn this into a macro where I can pass the argument for the values between the slashes. For the life of me I can't figure out what my macro should look like or how to call it. The documentation on macros really stinks.&lt;/P&gt;</description>
    <pubDate>Fri, 30 Dec 2011 20:18:53 GMT</pubDate>
    <dc:creator>kmattern</dc:creator>
    <dc:date>2011-12-30T20:18:53Z</dc:date>
    <item>
      <title>Macro Arguments</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42732#M391</link>
      <description>&lt;P&gt;I'm totally lost when it comes to arguments in macros. Here is what I want to do. I have three partial searches that are almost identical. &lt;/P&gt;

&lt;P&gt;sourcetype="iis" cs_username!="-" /TM/ .pdf&lt;/P&gt;

&lt;P&gt;sourcetype="iis" cs_username!="-" /TD/ .pdf&lt;/P&gt;

&lt;P&gt;sourcetype="iis" cs_username!="-" /TDB/ .pdf&lt;/P&gt;

&lt;P&gt;I would like to turn this into a macro where I can pass the argument for the values between the slashes. For the life of me I can't figure out what my macro should look like or how to call it. The documentation on macros really stinks.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Dec 2011 20:18:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42732#M391</guid>
      <dc:creator>kmattern</dc:creator>
      <dc:date>2011-12-30T20:18:53Z</dc:date>
    </item>
    <item>
      <title>Re: Macro Arguments</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42733#M392</link>
      <description>&lt;P&gt;Hi kmattem,&lt;/P&gt;

&lt;P&gt;You want a single parameter macro, with one argument:&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;macros.conf&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[iis_search(1)]
args = fragment
definition = sourcetype="iis" cs_username!="-" /$fragment$/ .pdf
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And call it like so&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;`iis_search(fragment=TM)`
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 30 Dec 2011 21:32:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42733#M392</guid>
      <dc:creator>dart</dc:creator>
      <dc:date>2011-12-30T21:32:20Z</dc:date>
    </item>
    <item>
      <title>Re: Macro Arguments</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42734#M393</link>
      <description>&lt;P&gt;If you do this through the user interface, fill in the form as follows:&lt;/P&gt;

&lt;P&gt;In the Name box, enter iis_search(1)&lt;/P&gt;

&lt;P&gt;Under Definition, enter sourcetype="iis" cs_username!="-" /$fragment$/ .pdf&lt;/P&gt;

&lt;P&gt;Under Arguments, enter fragment&lt;/P&gt;</description>
      <pubDate>Sun, 01 Jan 2012 05:38:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Macro-Arguments/m-p/42734#M393</guid>
      <dc:creator>lguinn2</dc:creator>
      <dc:date>2012-01-01T05:38:56Z</dc:date>
    </item>
  </channel>
</rss>

