Knowledge Management

Create search macro with return value

yko84109
Loves-to-Learn

Hi,

I want to create my search macro to return new field.
Example:

my_search_macro("1")

I want to return a new field, test, that contains "your value is " + $arg$

What I'm tried to write in search macro definition:

|eval test="your value is " + $arg$

But when I execute my search command as follow:

|makeresults | eval msg = my_search_macro("1") | table msg

I got an error.
So how can I simply create search macro with return value?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Macros are simple text substitutions, not functions. Your example query expands to | makeresults | eval msg = eval test="your value is foo" | table msg, which is why you get an error. Try changing the macro to "your value is " + $arg$ and be sure to check the "eval" box.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...