How to edit Macro from a search dashboard checklist?

[kamrankayani]

Hi all,

My aim is to have a checklist in a dashboard and according to what is selected, the content or description of a specific Macro is amended.

For example.

Checklist1

Tom ✔
Jerry
Peter ✔
Pan

Macro1 = "Tom, Peter"

Is there a way in doing this?

Thanks in advance!

[VatsalJagani]

Hi @knielsen,

You need to do rest call (/servicesNS/admin//configs/conf-macros/) to macro conf file to update macro definition. The following two ways you can try.

With Python
- Write custom command (commands.conf, bin/python-file)
- Use splunk.rest.SimpleRequest to call on /servicesNS/admin//configs/conf-macros/ with POST method to update value - Reference
- Call custom command from a search and pass the selected values as argument to custom command.

With Javascript
Call given rest call (/servicesNS/admin//configs/conf-macros/) from javascript as well. Reference

[knielsen]

Well, you can't use "," as part of a macro name. So if you want to use a delimiter, "_" would be my choice, eg something like

  <fieldset submitButton="false">
    <input type="checkbox" token="Macro1">
      <label>field1</label>
      <choice value="Tom">Tom</choice>
      <choice value="Jerry">Jerry</choice>
      <choice value="Peter">Peter</choice>
      <choice value="Pan">Pan</choice>
      <delimiter>_</delimiter>
    </input>
  </fieldset>

You can then simply use it in your query like

<query>index=foo ... | `$Macro1$` ... </query>

So "Tom, Peter" won't work, but "Tom_Peter" does.

[kamrankayani]

Hey Knielsen,

Thank you for your prompt reply..
This is a bit different to what I am trying to achieve. Reason I am using Macros rather than Token, is because the parameter it stores I would like to use it against several dashboards instead of just the one local dashboard.
The Macro I would like to amend is stored in Settings > Advanced Search > Macros

Thanks again.

[knielsen]

Yeah, I misunderstood I guess.

You want to change existing macros? It is possible (but not easy) to use the REST API for that, but there is no direct way of doing that without some external scripting AFAIK.

Search for topics on REST API and macros for a start, or wait for someone who can give better advise. I just played around with it for a little, but that's really nothing I can help directly with.

[kamrankayani]

No worries, thanks for your help again!