topic How to use macros in tstats and calling different macros based on the value of the parameter in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-macros-in-tstats-and-calling-different-macros-based/m-p/384047#M168885 <P>Hi. I wanted to use a macro to call a different macro based on the parameter and the definition of the sub-macro is from the "tstats" command. For example,</P> <PRE><CODE>[parentMacro(1)] args=source definition=CASE($source$="xyz", `childMacro_xyz`, $source$="abc", `childMacro_abc`) [childMacro_xyz] definition= tstats count WHERE index=blah where source="xyz" [childMacro_abc] definition= tstats count WHERE index=blah where source="abc" </CODE></PRE> <P>I got "Search Factory: Unknown search command 'case'" while using the following </P> <PRE><CODE>| makeresults | eval source="xyz" |`parentMacro(source)` </CODE></PRE> <P>Any clues? Thanks.</P> Thu, 14 Jun 2018 15:29:34 GMT splunkrocks2014 2018-06-14T15:29:34Z How to use macros in tstats and calling different macros based on the value of the parameter https://community.splunk.com/t5/Splunk-Search/How-to-use-macros-in-tstats-and-calling-different-macros-based/m-p/384047#M168885 <P>Hi. I wanted to use a macro to call a different macro based on the parameter and the definition of the sub-macro is from the "tstats" command. For example,</P> <PRE><CODE>[parentMacro(1)] args=source definition=CASE($source$="xyz", `childMacro_xyz`, $source$="abc", `childMacro_abc`) [childMacro_xyz] definition= tstats count WHERE index=blah where source="xyz" [childMacro_abc] definition= tstats count WHERE index=blah where source="abc" </CODE></PRE> <P>I got "Search Factory: Unknown search command 'case'" while using the following </P> <PRE><CODE>| makeresults | eval source="xyz" |`parentMacro(source)` </CODE></PRE> <P>Any clues? Thanks.</P> Thu, 14 Jun 2018 15:29:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-macros-in-tstats-and-calling-different-macros-based/m-p/384047#M168885 splunkrocks2014 2018-06-14T15:29:34Z Re: How to use macros in tstats and calling different macros based on the value of the parameter https://community.splunk.com/t5/Splunk-Search/How-to-use-macros-in-tstats-and-calling-different-macros-based/m-p/384048#M168886 <PRE><CODE> | search`parentMacro(source)` </CODE></PRE> <P>?<BR /> Or include the search command in the macro, although that might only fix the first issue I can see there...</P> Fri, 15 Jun 2018 08:53:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-macros-in-tstats-and-calling-different-macros-based/m-p/384048#M168886 gjanders 2018-06-15T08:53:26Z