Knowledge Management
Highlighted

Is it possible to have optional arguments in search macros?

Communicator

Hello,

I'm reading about search macros, and I was wondering if there was a way to have optional arguments? From what I've read, the definitions of arguments is an absolute number ( e.g. foo(#) ). The most obvious solution would be to make a macro with the same name with 1, 2, 3, 4, etc arguments for the expected combinations of optional arguments.

Maybe defining the number of arguments to be an impossibly large number and formulate the search such that it works with null fields?

I don't have a concrete example, but something that comes to mind could be a complex or bulky search that could take any number of fields. Just trying to figure out what I can and can't do with macros.

Thanks!

Tags (1)
Highlighted

Re: Is it possible to have optional arguments in search macros?

SplunkTrust
SplunkTrust

I usually do what I do with overloaded functions: Define one know-it-all version with n arguments, and feeder versions with lower-than-n arguments. Simple example:

`my_top(1)` --> `my_top($field$, 20)`
`my_top(2)` --> stats count by $field$ | sort - count | head $num$

The user of the macro can choose to define the optional num argument or not, then he gets the default of 20. For this example zero arguments would only make sense if you could reasonably guess a default field name to count by.

View solution in original post