topic Re: How to include arguments in search macros with non-alphanumeric values in Splunk Search

How to include arguments in search macros with non-alphanumeric values

cherrypick — Thu, 15 Aug 2024 02:04:57 GMT

I have arguments for my macro that contain other values e.g. $env:user$ and $timepicker.earliest$/$timepicker.latest$. How do I include these in my macro definition as it doesn't allow me since macro arguments must only contain alphanumeric, '_' and '-' characters?

Re: How to include arguments in search macros with non-alphanumeric values

cherrypick — Thu, 15 Aug 2024 02:39:15 GMT

Or is there another way to use re-usable SPL searches that can take these values into account?

Re: How to include arguments in search macros with non-alphanumeric values

yuanliu — Thu, 15 Aug 2024 06:37:16 GMT

Use macro params to pass these tokens. Here is an example:

Name	Definition	Arguments
non-alphabetic-token(2)	index=_internal earliest=$earliest_tok$ latest=$latest_tok$	earliest_tok, latest_tok

<form version="1.1" theme="light"> <label>Non-alphabetic tokens</label> <description>https://community.splunk.com/t5/Splunk-Search/How-to-include-arguments-in-search-macros-with-non-alphanumeric/m-p/696333#M236667</description> <fieldset submitButton="false"> <input type="time" token="timepicker" searchWhenChanged="true"> <label>pick time</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>$timepicker.earliest$</title> <table> <search> <query>`non-alphabetic-token($timepicker.earliest$, $timepicker.latest$)` | addinfo | stats count by info_min_time info_max_time | foreach info_* [eval <<FIELD>> = strftime(<<FIELD>>, "%F %T")]</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

Here are some sample interactions:

Re: How to include arguments in search macros with non-alphanumeric values

PickleRick — Thu, 15 Aug 2024 08:25:45 GMT

I'm not sure you understand the macros correctly.

if you define a macro with two parameters paramA and paramB it will get substituted in your search with whatever values you specify for them. These are separate layers.

Re: How to include arguments in search macros with non-alphanumeric values

cherrypick — Fri, 16 Aug 2024 03:07:29 GMT

Amazing! Thank you. Yes I misunderstood macros.