Splunk Enterprise

How to pass a value by reference into a macro? Do I used eval-based definition, and if so, how does it work?

gmagnant
New Member

I wrote a simple macro for a string builder for a full name when passed params for FirstName, MiddleName, and LastName.;  first screenshot - the macro definition 

I can pass the values explicitly to the macro but not by reference from the query that invokes the macro;  second screenshot shows the behavior of the macro both when I explicitly pass the values to it and when I attempt to do so by reference when "Use eval-based definition": is NOT checked.

If I DO check the box for "Use eval-based definition",  I get the following error:
"Error in 'SearchParser': The definition of macro 'CRE_getFullNameTEST(3)' is expected to be an eval expression that returns a string."

What do I have to do to be able to pass the values contained within FirstName, MiddleName, and LastName to my macro?

Thanks for any assistance with this.

Macro definitionMacro definitionSPL that invokes macroSPL that invokes macro

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

ITWhisperer_0-1679127152455.png

 

ITWhisperer_1-1679127250607.png

 

0 Karma

gmagnant
New Member

Many thanks for pointing out the syntax for concatenating a string in the macro. 

Works like a charm now. 

Now I can go create my dashboard URL builder macro which will be used to send the URL via Splunk alert into a ticketing application.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...