Knowledge Management

How to pass multiple values to one argument in a macro?

Shan
Builder

Hi All,

I need help from you.
I have a macro with 4 arguments(ASSIGNEE,Branch,month,year). Out of those 4 arguments, 2 are multi value fields(ASSIGNEE,Branch).
Both these "ASSIGNEE" and "Branch" arguments receive inputs from a multi-select field. But, when i select more than 2 values in multi-select, then it starts throwing an error.
Please help me to achieve passing multiple values to the same arguments.

Thanks ...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth

When you select multiple values from multiselect then it will return string with space separated if delimiter not specified.

Please check below example where I have specified comma as a delimiter and used in search panel. In search I'm passing this value after converting it to multivalue.

<form>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype">
      <label>sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | stats count by sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> ,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$sourcetype$</title>
        <search>
          <query>|makeresults | eval sourcetype="$sourcetype$",sourcetype=split(sourcetype,",") | `test1(sourcetype)`</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Macro:

Name: test1(1)

Definition: eval In_sourcetype=$sourcetype$,count=mvcount(In_sourcetype)

Arguments: sourcetype

Let me know for further assistance.

Thanks

0 Karma

Shan
Builder

@ kamlesh_vaghela,

Hai Thanks for the reply.

I have complete query in my macro. It's starting with index(macro query) .. when i use above suggestion its throwing error and also i have two multi-select field in query(macro).

Above suggestion is not working...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth
Can you please share your sample dashboard and macro definitions? Make sure you are not sharing original index names and other details.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...