Knowledge Management

How to pass multiple values to one argument in a macro?

Shan
Builder

Hi All,

I need help from you.
I have a macro with 4 arguments(ASSIGNEE,Branch,month,year). Out of those 4 arguments, 2 are multi value fields(ASSIGNEE,Branch).
Both these "ASSIGNEE" and "Branch" arguments receive inputs from a multi-select field. But, when i select more than 2 values in multi-select, then it starts throwing an error.
Please help me to achieve passing multiple values to the same arguments.

Thanks ...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth

When you select multiple values from multiselect then it will return string with space separated if delimiter not specified.

Please check below example where I have specified comma as a delimiter and used in search panel. In search I'm passing this value after converting it to multivalue.

<form>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype">
      <label>sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | stats count by sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> ,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$sourcetype$</title>
        <search>
          <query>|makeresults | eval sourcetype="$sourcetype$",sourcetype=split(sourcetype,",") | `test1(sourcetype)`</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Macro:

Name: test1(1)

Definition: eval In_sourcetype=$sourcetype$,count=mvcount(In_sourcetype)

Arguments: sourcetype

Let me know for further assistance.

Thanks

0 Karma

Shan
Builder

@ kamlesh_vaghela,

Hai Thanks for the reply.

I have complete query in my macro. It's starting with index(macro query) .. when i use above suggestion its throwing error and also i have two multi-select field in query(macro).

Above suggestion is not working...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth
Can you please share your sample dashboard and macro definitions? Make sure you are not sharing original index names and other details.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...