Knowledge Management

How to pass multiple values to one argument in a macro?

Shan
Builder

Hi All,

I need help from you.
I have a macro with 4 arguments(ASSIGNEE,Branch,month,year). Out of those 4 arguments, 2 are multi value fields(ASSIGNEE,Branch).
Both these "ASSIGNEE" and "Branch" arguments receive inputs from a multi-select field. But, when i select more than 2 values in multi-select, then it starts throwing an error.
Please help me to achieve passing multiple values to the same arguments.

Thanks ...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth

When you select multiple values from multiselect then it will return string with space separated if delimiter not specified.

Please check below example where I have specified comma as a delimiter and used in search panel. In search I'm passing this value after converting it to multivalue.

<form>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype">
      <label>sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | stats count by sourcetype</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> ,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$sourcetype$</title>
        <search>
          <query>|makeresults | eval sourcetype="$sourcetype$",sourcetype=split(sourcetype,",") | `test1(sourcetype)`</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Macro:

Name: test1(1)

Definition: eval In_sourcetype=$sourcetype$,count=mvcount(In_sourcetype)

Arguments: sourcetype

Let me know for further assistance.

Thanks

0 Karma

Shan
Builder

@ kamlesh_vaghela,

Hai Thanks for the reply.

I have complete query in my macro. It's starting with index(macro query) .. when i use above suggestion its throwing error and also i have two multi-select field in query(macro).

Above suggestion is not working...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth
Can you please share your sample dashboard and macro definitions? Make sure you are not sharing original index names and other details.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...