Knowledge Management

macro - how to run macro in eval case

New Member

I made ​​macros.

test_macro1, test_macro2

The macros are the result comes out

But macros will now run in eval case

Query statement

index = main | eval a = case (field> 1, test_macro1, field == 0, test_macro2)

Will this query should not run?

Tags (1)
0 Karma


Hi mrain7,

no, this will only set the value of a based on the condition to either test_macro1 or test_macro2.
But you could build this as macro and provide the where statement as argument, lets start with a run everywhere example:

index=_internal | eventstats count(sourcetype) as myCount by sourcetype | where myCount<100 | timechart span=1m values(myCount) as myCount by sourcetype

this returns the count per sourcetype over time. Now we replace the where condition with a placeholder like $wherearg$ and create it as macro as described in the docs here and name it count_sourcetype.

You can now call the marco like this:


and it will use the myCount<100 as condition of where and returns only results where the count per time range is under 100 events.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...