Knowledge Management

Is it possible to have optional arguments in search macros?

j4adam
Communicator

Hello,

I'm reading about search macros, and I was wondering if there was a way to have optional arguments? From what I've read, the definitions of arguments is an absolute number ( e.g. foo(#) ). The most obvious solution would be to make a macro with the same name with 1, 2, 3, 4, etc arguments for the expected combinations of optional arguments.

Maybe defining the number of arguments to be an impossibly large number and formulate the search such that it works with null fields?

I don't have a concrete example, but something that comes to mind could be a complex or bulky search that could take any number of fields. Just trying to figure out what I can and can't do with macros.

Thanks!

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:

`my_top(1)` --> `my_top($field$, 20)`
`my_top(2)` --> stats count by $field$ | sort - count | head $num$

The user of the macro can choose to define the optional num argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:

`my_top(1)` --> `my_top($field$, 20)`
`my_top(2)` --> stats count by $field$ | sort - count | head $num$

The user of the macro can choose to define the optional num argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...