How to pass field values as macro arguments?

[andra_pietraru]

Hi,

I am trying to pass a field as an argument for a macro that I have defined, but it's not working.
My macro looks like:

[search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | head 1]

My query is:

sourcetype=type2|eval newField=`newMacro(field3)`|table newField,field3

If I pass a value (e.g: newMacro(0001)) it works. Can someone tell me how to pass field3 as an argument?
Thanks!

[darljedmatundan]

I am browsing to look for a solution to this issue and eventually accidentally found a solution myself. Try if this will work for you. 

search sourcetype=type1 field1='$arg1$' | rename field2 as query | fields query | eval newField=query

 Single quotes will return the value of the field in an eval expression.

[masonmorales]

Your eval should be in the macro, so you'd just call it and pass it field3. i.e.:

 sourcetype=type2|`newMacro(field3)`|table newField,field3

Let me know if you need help with the macro itself.

[wbcem]

Mason - I'm trying to replicate your code so that I can pass a field into a macro instead of a string, something that I really need to do to get around an data import issue that I have no immediate control over.

I'm using the same syntax you had suggested, newmacro(field3). However, The name of the field is getting passed into the macro as a string instead the value of the field. I do not have quotes around the field.

Got any suggestions?

[bwlm]

I am trying to figure out the same issue as well...

[andra_pietraru]

I would like to get an idea for the macro as well.
Now the macro I have looks like:

search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query

Thanks!

[masonmorales]

Try changing it to

appendcols [ search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query]

or

append [ search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query]

[andra_pietraru]

I tried both. The first one gives error :"Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart)".
The second one doesn't give error. But the newField column is empty. Any ideas why? Could it be because I have two different sourcetypes?