Macro Arguments

[kmattern]

I'm totally lost when it comes to arguments in macros. Here is what I want to do. I have three partial searches that are almost identical.

sourcetype="iis" cs_username!="-" /TM/ .pdf

sourcetype="iis" cs_username!="-" /TD/ .pdf

sourcetype="iis" cs_username!="-" /TDB/ .pdf

I would like to turn this into a macro where I can pass the argument for the values between the slashes. For the life of me I can't figure out what my macro should look like or how to call it. The documentation on macros really stinks.

[dart · Accepted solution]

Hi kmattem,

You want a single parameter macro, with one argument:

macros.conf

[iis_search(1)]
args = fragment
definition = sourcetype="iis" cs_username!="-" /$fragment$/ .pdf

And call it like so

`iis_search(fragment=TM)`

[lguinn2]

If you do this through the user interface, fill in the form as follows:

In the Name box, enter iis_search(1)

Under Definition, enter sourcetype="iis" cs_username!="-" /$fragment$/ .pdf

Under Arguments, enter fragment