Knowledge Management

Is it possible to have optional arguments in search macros?

j4adam
Communicator

Hello,

I'm reading about search macros, and I was wondering if there was a way to have optional arguments? From what I've read, the definitions of arguments is an absolute number ( e.g. foo(#) ). The most obvious solution would be to make a macro with the same name with 1, 2, 3, 4, etc arguments for the expected combinations of optional arguments.

Maybe defining the number of arguments to be an impossibly large number and formulate the search such that it works with null fields?

I don't have a concrete example, but something that comes to mind could be a complex or bulky search that could take any number of fields. Just trying to figure out what I can and can't do with macros.

Thanks!

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:

`my_top(1)` --> `my_top($field$, 20)`
`my_top(2)` --> stats count by $field$ | sort - count | head $num$

The user of the macro can choose to define the optional num argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:

`my_top(1)` --> `my_top($field$, 20)`
`my_top(2)` --> stats count by $field$ | sort - count | head $num$

The user of the macro can choose to define the optional num argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...