Splunk Search

Can field values be used as a macro name?

mrain7
New Member

Can be used as a macro name field value?

EX)

index=_internal | table sourcetype | `sourcetype`

I have a 500 type
I want to use each type of each macro.

What should I do?

Tags (4)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

@stu2's link appears to be missing, so here's the short answer: No.

Slightly longer: Macros are evaluated before the search is run, while field values are known during the execution - too late. Macros are evaluated once per search, while field values exist once per row - too many.

Edit: found the link: http://answers.splunk.com/answers/144038/how-can-i-pass-field-value-as-macro-name.html

stu2
Explorer
0 Karma

somesoni2
Revered Legend

What is your requirement for creating these macros? you need different processing for each sourcetype?

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

PLATFORM TECH TALKS What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Thursday, February 27, ...