topic Re: How to pass field values as macro arguments? in Knowledge Management

How to pass field values as macro arguments?

andra_pietraru — Thu, 23 Apr 2015 13:02:43 GMT

Hi,

I am trying to pass a field as an argument for a macro that I have defined, but it's not working.
My macro looks like:

[search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | head 1]

My query is:

sourcetype=type2|eval newField=`newMacro(field3)`|table newField,field3

If I pass a value (e.g: newMacro(0001)) it works. Can someone tell me how to pass field3 as an argument?
Thanks!

Re: How to pass field values as macro arguments?

masonmorales — Thu, 23 Apr 2015 13:57:39 GMT

Your eval should be in the macro, so you'd just call it and pass it field3. i.e.:

 sourcetype=type2|`newMacro(field3)`|table newField,field3

Let me know if you need help with the macro itself.

Re: How to pass field values as macro arguments?

andra_pietraru — Thu, 23 Apr 2015 14:12:25 GMT

I would like to get an idea for the macro as well.
Now the macro I have looks like:

search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query

Thanks!

Re: How to pass field values as macro arguments?

masonmorales — Thu, 23 Apr 2015 15:39:22 GMT

Try changing it to

appendcols [ search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query]

append [ search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query]

Re: How to pass field values as macro arguments?

andra_pietraru — Fri, 24 Apr 2015 06:46:09 GMT

I tried both. The first one gives error :"Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart)".
The second one doesn't give error. But the newField column is empty. Any ideas why? Could it be because I have two different sourcetypes?

Re: How to pass field values as macro arguments?

wbcem — Tue, 17 Jan 2017 18:34:20 GMT

Mason - I'm trying to replicate your code so that I can pass a field into a macro instead of a string, something that I really need to do to get around an data import issue that I have no immediate control over.

I'm using the same syntax you had suggested, newmacro(field3). However, The name of the field is getting passed into the macro as a string instead the value of the field. I do not have quotes around the field.

Got any suggestions?

Re: How to pass field values as macro arguments?

bwlm — Mon, 23 Mar 2020 21:20:59 GMT

I am trying to figure out the same issue as well...

Re: How to pass field values as macro arguments?

darljedmatundan — Wed, 28 Feb 2024 05:02:27 GMT

I am browsing to look for a solution to this issue and eventually accidentally found a solution myself. Try if this will work for you.

search sourcetype=type1 field1='$arg1$' | rename field2 as query | fields query | eval newField=query

Single quotes will return the value of the field in an eval expression.