Hello,
I have a requirement where I need to have the name of the current running saved search available to itself. And to avoid human error, I am looking for an automated way of doing this.
Based on this question, I can use | eval search_name="$name$" and it works fine, but I was looking into a way of putting that inside a macro. Unfortunately, when doing that, search_name ends up with the literal value "$name$".
Is anyone doing something similar and has a solution?
Thank you
Hello @akai ,
The issue is $name$ inside the macro is no longer a token its more of a macro parameter.
In order to fix you need to pass $name$ as a macro argument from the saved search itself.
Define your macro to accept the search name as an argument — e.g., my_macro(1) with argument search_name. And macro definition would be something like this:
[my_macro(1)]
args = search_name
definition = eval search_name=$search_name|s$
Then you can call the macro like this:
.....
| `my_macro($name$)`
| table search_name
I hope this helps!!!