Dashboards & Visualizations

Is it possible to pass token values into a macro?

smcdonald20
Path Finder

I have a dashboard with multiple panels. Each panel has a different search, which i want to replace with a macro.
The problem is, i want to be able to filter with tokens.

My question is, can i have a Macro that has token values within it, that can be passed from the inputs on the dashboard.

Example

Macro "Username ": index=ad source=userscan username=$username$

Dashboard input token = $username$

Panel search: "Username"

I cannot currently get this to work. Wondering do i need to do something another way?

Tags (2)
0 Karma

renjith_nair
Legend

You could pass arguments to macro like

`macroname(param1)`

Please have a look : https://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Searchmacroexamples

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...