Is it possible to calculate the name of a macro to be used in a search from a token value?
I have a drop down list of system names that I have corresponding macros for.
key = ABC - macro = ABChosts
key = DEF - macro = DEFhosts
key = GHI - macro = GHI_hosts
When a user selects an item from the list I want to use the token in my search to compute which macro to use. Is there a way to compute the macro name in the search?
if the user selected ABC I would like the search to have the following calculated using the token
Well, in theory tokens are replaced in a dashboard before the search runs, so this should work as long as
ABC_hosts uses the proper format of a macro
so, just try it and see if it works for you 😉
Thanks Mas for the response, I guess my problem is how to I turn the value to my token into a macro.
I'm not sure of the syntax, how do I add the value of the token and _hosts and have splunk treat it as a macro?
so it my token value is ABC I want to add host to it an pop some quotes around it so it becomes 'ABChosts'
Thanks in advance
@Melstrathdee there would be multiple ways to do this
<change> event handler for dropdown to set for macro to be replaced in search query
<change> event handler for dropdown to set complete search query with macro replaced selected value.
3) Modify SPL to have macro call and actual macro value to be replaced with value selected in dropdown. (As pointed out my @MuS)
You should be able to find examples of each on Splunk answers.
If you can give sample SPL to be invoked for couple of dropdown values selected we would be able to assist you with specific option you want to implement.
Thanks guys I got it working using the following code:
it basically puts the macros with thei name and code in a table and returns one column as the name and the the search string column as the field value.
Thanks for the help
| eval sysName = substr(title, 1, len(title)-6)
| Table sysName, title, definition