Create search macro with return value

yko84109 — Wed, 30 Sep 2020 01:10:50 GMT

Hi,

I want to create my search macro to return new field.
Example:

my_search_macro("1")

I want to return a new field, test, that contains "your value is " + $arg$

What I'm tried to write in search macro definition:

|eval test="your value is " + $arg$

But when I execute my search command as follow:

|makeresults | eval msg = my_search_macro("1") | table msg

I got an error.
So how can I simply create search macro with return value?

Thanks

Re: Create search macro with return value

richgalloway — Thu, 04 Jul 2019 14:39:17 GMT

Macros are simple text substitutions, not functions. Your example query expands to | makeresults | eval msg = eval test="your value is foo" | table msg, which is why you get an error. Try changing the macro to "your value is " + $arg$ and be sure to check the "eval" box.

topic Create search macro with return value in Knowledge Management

Create search macro with return value

Re: Create search macro with return value