Knowledge Management

Macro Arguments

kmattern
Builder

I'm totally lost when it comes to arguments in macros. Here is what I want to do. I have three partial searches that are almost identical.

sourcetype="iis" cs_username!="-" /TM/ .pdf

sourcetype="iis" cs_username!="-" /TD/ .pdf

sourcetype="iis" cs_username!="-" /TDB/ .pdf

I would like to turn this into a macro where I can pass the argument for the values between the slashes. For the life of me I can't figure out what my macro should look like or how to call it. The documentation on macros really stinks.

Tags (2)
1 Solution

dart
Splunk Employee
Splunk Employee

Hi kmattem,

You want a single parameter macro, with one argument:

macros.conf

[iis_search(1)]
args = fragment
definition = sourcetype="iis" cs_username!="-" /$fragment$/ .pdf

And call it like so

`iis_search(fragment=TM)`

View solution in original post

dart
Splunk Employee
Splunk Employee

Hi kmattem,

You want a single parameter macro, with one argument:

macros.conf

[iis_search(1)]
args = fragment
definition = sourcetype="iis" cs_username!="-" /$fragment$/ .pdf

And call it like so

`iis_search(fragment=TM)`

lguinn2
Legend

If you do this through the user interface, fill in the form as follows:

In the Name box, enter iis_search(1)

Under Definition, enter sourcetype="iis" cs_username!="-" /$fragment$/ .pdf

Under Arguments, enter fragment

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...