topic Re: How can I pass field value as macro name in Splunk Search

How can I pass field value as macro name

pradeepkumarg — Mon, 07 Jul 2014 21:09:22 GMT

I have two macros with names yes and no

Now, I want to refer to these macros in my search query, but not by directly calling them with the name

My query looks something like below



...| eval FLAG=if(fieldA!=fieldb,yes,no) | `FLAG`

I want the FLAG field to be substituted with yes or no so that my corresponding macro is called.

With the above approach, I suppose it looks for a macro with the name FLAG.

How can I achieve this?

Re: How can I pass field value as macro name

martin_mueller — Tue, 08 Jul 2014 00:14:14 GMT

Macro substitution happens once before the search is started, so it cannot depend on field values.

What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.

Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1) like this:

if("$selection$"=="*", "fieldA", "fieldB")

Then change your search to this:

... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`

That'll select fieldA if your token has been set to *, fieldB otherwise.

Re: How can I pass field value as macro name

pradeepkumarg — Tue, 08 Jul 2014 00:41:53 GMT

Hi Martin, here is my actual requirement.

I have a drop down in my dashboard. I want to change the search query of the panel based on the option selected from drop down.

If * (All) is selected from the drop down my search query should be ...| stats sum(total_amount) by fieldA

If any other value is selected from the drop down, my search query should be ..| stats sum(total_amount) by fieldB

Re: How can I pass field value as macro name

martin_mueller — Tue, 08 Jul 2014 01:26:48 GMT

Is that the only purpose of the dropdown?

Re: How can I pass field value as macro name

pradeepkumarg — Tue, 08 Jul 2014 01:46:48 GMT

Other panels in the dashboard as well use the same drop down to filter the data.

Re: How can I pass field value as macro name

martin_mueller — Tue, 08 Jul 2014 01:55:42 GMT

Okay, you can use an eval-based macro to decide the field name - this works because you're not actually deciding based on a field value but rather on a token. That's known and unique before running the search, so the macro substitution works. I've added an example to the answer above.

Re: How can I pass field value as macro name

pradeepkumarg — Tue, 08 Jul 2014 15:14:25 GMT

Perfect. Thanks Martin!