<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Insert field value into macro parameter in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/504098#M4538</link>
    <description>&lt;P&gt;This is not working in my case. How can I pass a field value as a parameter to a macro?&lt;/P&gt;</description>
    <pubDate>Fri, 12 Jun 2020 09:16:01 GMT</pubDate>
    <dc:creator>santosh_sshanbh</dc:creator>
    <dc:date>2020-06-12T09:16:01Z</dc:date>
    <item>
      <title>Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239536#M2096</link>
      <description>&lt;P&gt;Hi everybody,&lt;/P&gt;

&lt;P&gt;I have this search, using a macro called &lt;CODE&gt;getImageURL(2)&lt;/CODE&gt;:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...
table country client artnumber | 
eval sql = if(client==2,[|`getImageURL(2,artnumber )`], sql)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;If I type artnumber directly, e.g. "1234", everything is fine.&lt;/P&gt;

&lt;P&gt;If I use the artnumber field, the macro does not accept the field value as a parameter. (it is interpreting it as a string)&lt;/P&gt;

&lt;P&gt;Does anyone know how to use the field value of "artnumber"?&lt;/P&gt;

&lt;P&gt;Best regards in advance&lt;BR /&gt;
Steffen&lt;/P&gt;</description>
      <pubDate>Thu, 07 Jul 2016 15:08:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239536#M2096</guid>
      <dc:creator>tcoq</dc:creator>
      <dc:date>2016-07-07T15:08:50Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239537#M2097</link>
      <description>&lt;P&gt;Try to put our whole eval inside macro and then use the macro in your search&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Macro definition:   eval sql=if($client$==2,yourcurrentMacroCode,sql)
Params: client, artnumber
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;your Search&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...
 table country client artnumber | `getImageURL(client,artnumber )`
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 07 Jul 2016 15:19:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239537#M2097</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2016-07-07T15:19:45Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239538#M2098</link>
      <description>&lt;P&gt;The problem is that your macro is embedded inside a (contextually isolated) &lt;CODE&gt;subsearch&lt;/CODE&gt;.  All &lt;CODE&gt;subsearches&lt;/CODE&gt; run FIRST, before anything else.  In this case, that means that the &lt;CODE&gt;artnumber&lt;/CODE&gt; field name that you are using inside of your &lt;CODE&gt;macro&lt;/CODE&gt; call doesn't exist because no events from the outer search exist inside of the inner &lt;CODE&gt;macro&lt;/CODE&gt;.  This is absolutely the problem.  It is not clear to me why you are using a &lt;CODE&gt;subsearch&lt;/CODE&gt; (mostly because you have not shared the guts of your &lt;CODE&gt;macro&lt;/CODE&gt;), but perhaps you can just get rid of the square brackets and not use a &lt;CODE&gt;subsearch&lt;/CODE&gt; at all.&lt;/P&gt;</description>
      <pubDate>Thu, 07 Jul 2016 16:00:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239538#M2098</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2016-07-07T16:00:43Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239539#M2099</link>
      <description>&lt;P&gt;I am using a subsearch, because inside of the macro there is a dbx-query search to a secondary database.(DB-Connect) DBX must be at the beginning of a search and only a subseach allows to put it at the beginning...&lt;/P&gt;</description>
      <pubDate>Fri, 08 Jul 2016 11:24:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239539#M2099</guid>
      <dc:creator>tcoq</dc:creator>
      <dc:date>2016-07-08T11:24:10Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239540#M2100</link>
      <description>&lt;P&gt;It is the same problem like the upper advice. Inside of the macro is a dbx sql-query which must be at the beginning of a search. So I need to do a subsearch...&lt;/P&gt;</description>
      <pubDate>Fri, 08 Jul 2016 11:26:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239540#M2100</guid>
      <dc:creator>tcoq</dc:creator>
      <dc:date>2016-07-08T11:26:32Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239541#M2101</link>
      <description>&lt;P&gt;First, fix your &lt;CODE&gt;macro&lt;/CODE&gt; to handle a list of &lt;CODE&gt;artnumber&lt;/CODE&gt; values separated by pipe characters.  Then do this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; Your Base Search Here | outputcsv TempFile.csv | where ThisFieldWillNotExist="So this drops all aevents"
| appendpipe [ `getImageURL(2, [|inputcsv TempFile.csv | search client="2" | fields artnumber | | format "(" "" "" "" "|" ")" | rex field=search mode=sed "s/\" | artnumber=\"//g"]` | outputlookup YourLookupDefintionHere | where ThisFieldWillNotExist="So this drops all aevents"]
| appendpipe [ |inputcsv TempFile.csv | lookup YourLookupDefintionHere artnumber OUTPUT sql ]
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The first line saves off the base search results and then throws all events away.&lt;BR /&gt;
The second line uses those same search results to create a lookup file (you may need to adjust some stuff here) and then clears the slate again.&lt;BR /&gt;
The third line reads in the events one more time and runs them through the lookup file that you just created.&lt;/P&gt;</description>
      <pubDate>Fri, 08 Jul 2016 13:59:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239541#M2101</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2016-07-08T13:59:22Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239542#M2102</link>
      <description>&lt;P&gt;I found a less complicated solution for my case based on map command:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...
table country client artnumber | 
| map maxsearches=15 search="|`getImageURL(2,$artnumber$)`"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 11 Jul 2016 06:23:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/239542#M2102</guid>
      <dc:creator>tcoq</dc:creator>
      <dc:date>2016-07-11T06:23:28Z</dc:date>
    </item>
    <item>
      <title>Re: Insert field value into macro parameter</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/504098#M4538</link>
      <description>&lt;P&gt;This is not working in my case. How can I pass a field value as a parameter to a macro?&lt;/P&gt;</description>
      <pubDate>Fri, 12 Jun 2020 09:16:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Insert-field-value-into-macro-parameter/m-p/504098#M4538</guid>
      <dc:creator>santosh_sshanbh</dc:creator>
      <dc:date>2020-06-12T09:16:01Z</dc:date>
    </item>
  </channel>
</rss>

