topic Re: Issue with Macros in Knowledge Management

Issue with Macros

theouhuios — Fri, 19 Oct 2012 14:23:29 GMT

Hello

I have a very complex search which I want to break into 2 macros. I did create a macro but didn't mention any arguments or anything else other than the name and definition. Can anyone please help me on where I am doing a mistake. I did go through the documentation about arguments but couldn't understand how to define it properly.

Here is the first one

eval mybucket=case(date_hour<4,1,date_hour<8,2,date_hour<12,3,date_hour<16,4,date_hour<20,5,date_hour>0,6) | stats count as I by WG, mybucket,date_mday,date_month,date_year

And the second one is

delta I as D  | eval D = abs(D) | eventstats avg(I) as xbar, avg(D) as mbar by WG | eval threshold = xbar + (2.66*mbar) | eval threshold=coalesce(threshold,0) | dedup WG | fields WG threshold | table WG threshold

Do I need to mention any arguments or give any validation? I did check the use eval-based definition box though. Any help?

Regards

theou

Re: Issue with Macros

sdaniels — Fri, 19 Oct 2012 15:18:00 GMT

Yes, you need to specify arguments. Here is a linear tread macro:

eventstats count as numevents sum($x$) as sumX sum($y$) as sumY sum(eval($x$*$y$)) as sumXY sum(eval($x$*$x$)) as sumX2 sum(eval($y$*$y$)) as sumY2 | eval slope=((numevents*sumXY)-(sumX*sumY))/((numevents*sumX2)-(sumX*sumX)) | eval yintercept=
(sumY-(slope*sumX))/numevents | eval newY=(yintercept + (slope*$x$)) | eval R=((numevents*sumXY) - (sumX*sumY))/sqrt(((numevents*sumX2)-(sumX*sumX))*
((numevents*sumY2)-(sumY*sumY))) | eval R2=R*R

Under 'Argument' on the macro definition page i have x,y as my arguments. You'll see them in the macro definition above surrounded by $ signs like $x$. When i call this from the search will look like this - `lineartrent(arg1,arg2)` and the args will get pass into the macro for you. You can then reference fields created or that exist in your macro and use them in further searches or pass them onto another macro etc.