topic Re: How to edit Macro from a search dashboard checklist? in Dashboards & Visualizations

How to edit Macro from a search dashboard checklist?

kamrankayani — Wed, 24 Apr 2019 08:58:36 GMT

Hi all,

My aim is to have a checklist in a dashboard and according to what is selected, the content or description of a specific Macro is amended.

For example.

Checklist1

Tom ✔
Jerry
Peter ✔
Pan

Macro1 = "Tom, Peter"

Is there a way in doing this?

Thanks in advance!

Re: How to edit Macro from a search dashboard checklist?

knielsen — Wed, 24 Apr 2019 09:19:45 GMT

Well, you can't use "," as part of a macro name. So if you want to use a delimiter, "_" would be my choice, eg something like

  <fieldset submitButton="false">
    <input type="checkbox" token="Macro1">
      <label>field1</label>
      <choice value="Tom">Tom</choice>
      <choice value="Jerry">Jerry</choice>
      <choice value="Peter">Peter</choice>
      <choice value="Pan">Pan</choice>
      <delimiter>_</delimiter>
    </input>
  </fieldset>

You can then simply use it in your query like

<query>index=foo ... | `$Macro1$` ... </query>

So "Tom, Peter" won't work, but "Tom_Peter" does.

Re: How to edit Macro from a search dashboard checklist?

kamrankayani — Wed, 24 Apr 2019 09:47:32 GMT

Hey Knielsen,

Thank you for your prompt reply..
This is a bit different to what I am trying to achieve. Reason I am using Macros rather than Token, is because the parameter it stores I would like to use it against several dashboards instead of just the one local dashboard.
The Macro I would like to amend is stored in Settings > Advanced Search > Macros

Thanks again.

Re: How to edit Macro from a search dashboard checklist?

knielsen — Wed, 24 Apr 2019 11:21:08 GMT

Yeah, I misunderstood I guess.

You want to change existing macros? It is possible (but not easy) to use the REST API for that, but there is no direct way of doing that without some external scripting AFAIK.

Search for topics on REST API and macros for a start, or wait for someone who can give better advise. I just played around with it for a little, but that's really nothing I can help directly with.

Re: How to edit Macro from a search dashboard checklist?

kamrankayani — Wed, 24 Apr 2019 11:25:03 GMT

No worries, thanks for your help again!

Re: How to edit Macro from a search dashboard checklist?

VatsalJagani — Wed, 24 Apr 2019 12:47:18 GMT

Hi @knielsen,

You need to do rest call (/servicesNS/admin//configs/conf-macros/) to macro conf file to update macro definition. The following two ways you can try.

With Python
- Write custom command (commands.conf, bin/python-file)
- Use splunk.rest.SimpleRequest to call on /servicesNS/admin//configs/conf-macros/ with POST method to update value - Reference
- Call custom command from a search and pass the selected values as argument to custom command.

With Javascript
Call given rest call (/servicesNS/admin//configs/conf-macros/) from javascript as well. Reference