How to get macro definition populated in text box based on dropdown?

[Taruchit]

Hi All,

I need two input panels: dropdown and textbox, such that the dropdown gives a list of macros, and when we select one of the option, its corresponding macro definition gets loaded in the textbox. 

The underlying idea is to build a dashboard which helps to test and debug the code of each macro when it gets applied on the base search. 

Thus, when the macro definition gets loaded in the textbox, the user will need to have ability to edit and change the code in the textbox and apply the same on base search without modifying the actual macro definition during the debugging process.

Thank you

[JacekF · Accepted solution]

You can populate the dropdown with the following query:

| rest splunk_server="local" "/servicesNS/-/-/admin/macros"
| fields title definition

Use title as label field and definition as value and assign it to a token, which can later be used to display definition.

[Taruchit]

Thank you @JacekF for sharing your solution. 

It worked properly for me. 

There is one observation: -

From dropdown when I select a macro, the corresponding macro definition gets loaded in textbox. 
Then, I used the macro used for the textbox in base SPL. 

When I modify the macro definition in the textbox, the search results get updated accordingly.

But, after altering the text manually, if I try to select a new macro from dropdown, the corresponding macro definition does not get loaded in the textbox. As the result, I need to empty the textbox and then select the dropdown again to get the required macro definition. 

Please share if you have any insights about the above behavior.

[gcusello]

Hi @Taruchit,

in my knowldesge it isn't possible what you want.

You could go in the macro page where you can search all available macros (with some dropdown to filter them) and then manualy (CTRL-C CTRL-V) copy the code of one macro in the Search Dashboard.

I hint to insert your request in Splunk Idea, it could be an interesting feature to hint to the Splunk designers.

Ciao.

Giuseppe