Splunk Search

Can I use a macro within a macro?

Splunk Employee
Splunk Employee

Wondering if it's possible to embed a macro into another macro.

Tags (2)
0 Karma

Path Finder

See the Splunk documentation for this: http://docs.splunk.com/Splexicon:Searchmacro

Directly from the docs: "You can also nest search macros within each other."


Yes it is possible.

Here is one example.


args = count
definition = eval CountStatus=if($count$>100,"Heavy","Light")
iseval = 0

args = count
definition = `getCountStatus($count$)` | eval RowColor=if(CountStatus="Heavy","Read","Green")
iseval = 0


index=_internal earliest=-15m@m  | stats count by sourcetype |`getRowColorWithCountStatus(count)`
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...