Knowledge Management

how to run macro arguments

nivethainspire_
Explorer

I created a macro with 3 arguments in UI as,

sample(3) with definition 'index=shapes sourcetype=rectangle |search $height$ $weight$ $mode$ |.....'

In my search i called the macro as below

sample($height$,$weight$,$mode$)|...|...

I get an error.Can anyone help with exact way of writing this scenario.

Tags (1)
0 Karma

woodcock
Esteemed Legend

You call it EITHER with literals (e.g. "32") or with existing field names (e.g. weight and mode), without the dollar-signs, like this (assuming that you are not running this inside of a dashboard panel where you are trying to access dashboard tokens):

Your base search here | `sample("32",weight,mode)`
0 Karma

koshyk
Super Champion

you need to call macro with back-ticks
`sample($height$,$weight$,$mode$)`

0 Karma

niketn
Legend

@nivethainspire_07... You will also have to pass parameters as string to macro...So the tokens should be inside double quotes:

`sample("$height$","$weight$","$mode$")`
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...