Knowledge Management

dropdown token argument to macro argument

surekhasplunk
Communicator

Am using a macro with 1 argument
and while calling it to update my table with values am passing query as mymacro(arg1=*) and it works well.

Now my requirement is arg1 value is coming from dropdown selected value.
So if i have set token as field1 for the dropdown then how to use that as arg1 for macro.

i tried using mymacro(arg1=$field1$) but it isn't working.

Tags (2)
0 Karma

renjith_nair
Legend

@surekhasplunk ,

In macro, you just need to pass the token as mymacro($field1$) where field1 is your token.

Make sure that the argument list and definition of macro matches in terms of number of arguments and variable name

https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Usesearchmacros

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

niketn
Legend

@surekhasplunk, can you add dropdown code XML?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

surekhasplunk
Communicator
<input type="dropdown" token="field1" id="resized_input">
  <label>Business Area</label>
  <prefix>"</prefix>
  <suffix>"</suffix>
  <fieldForLabel>SubDivision 4</fieldForLabel>
  <fieldForValue>SubDivision 4</fieldForValue>
  <search>
    <query>|inputlookup file.csv| dedup  "SubDivision 4" | table "SubDivision 4"</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <choice value="*">ALL</choice>
  <default>*</default>
</input>

My field1 is a string and has got spaces in it.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...