Can I pass macros dynamically in the panels?

[smruti13]

I have created a drop down called Tower which is taking values from a lookup table and displaying the project names. Whenever I click on a particular project I want the macros used in that particular project to be passed to the panels . Is it possible?

[vasanthmss · Accepted solution]

yes, you can pass the macro's based on the token selection.

basic sample code:

<form>
  <label>Form example: source type time chart</label>

  <!--autoRun means the search runs as soon as it is loaded. -->
  <!-- Do not need a submit button                           -->
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="sourcetype_tok">
      <label>Select a source type</label>
      <default>splunkd</default>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="splunkd_ui_access">splunkd_ui_access</choice>
    </input>
  </fieldset>

  <row>
    <panel>
      <chart>
        <search>
          <query>
            index = _internal sourcetype=$sourcetype_tok$ 
            | timechart count by sourcetype
          </query>
            <earliest>-7d</earliest>
            <latest>-0d</latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

Insead of query use the following,

         <query>
           `your_macro($<your token>$)`
          </query>

In-case if you want to create / populate the macro you have to use sub search .

samples: https://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms