How do I pass a variable to a macro in a saved search?

[jks_at_senscons]

I want to pass a variable to a savedsearch using this method:

| savedsearch mySavedSearch1 inputParam1="value1"

Within "mySavedSearch1" I have a macro where I want to use the value of inputParam1:

|`myMacro1($inputParam1$)`

"myMacro1" contains the following

| tstats count where `indexes_$inputParam1$` by host

When I try to save mySavedSearch1 I get the following error:

Error in 'SearchParser': The name
'indexes_$inputParam1$' is invalid. Macro
and argument names may only include
alphanumerics, '_' and '-'.

The example is highly stripped and myMacro1 contains much more. The reason behind this setup is to be able to reuse myMacro1 both in reports and dashboards.

To me it seems like I am not able to turn the input parameter "inputParam1" into a value in mySavedSearch1.
Anyone who can help me out?

[FrankVl · Accepted solution]

The error is about this part:

| tstats count where `indexes_$inputParam1$` by host

Specifically that macro reference. Apparently, you're not allowed to use a token like that to have a dynamic macro reference. Can't you define that indexes_... macro such that it takes the token as input, rather than using it as part of the macro name? So you can do | tstats count whereindexes($inputParam1$)`.

[jks_at_senscons]

Thanks alot, FrankVI!
I did it the way you recommended and it worked.
I lost the option of chosing macros dynamically, but will try to fix that in another fashion. 🙂