Splunk Search
Highlighted

Can field values be used as a macro name?

New Member

Can be used as a macro name field value?

EX)

index=_internal | table sourcetype | `sourcetype`

I have a 500 type
I want to use each type of each macro.

What should I do?

Tags (4)
0 Karma
Highlighted

Re: Can field values be used as a macro name?

SplunkTrust
SplunkTrust

What is your requirement for creating these macros? you need different processing for each sourcetype?

0 Karma
Highlighted

Re: Can field values be used as a macro name?

Explorer
0 Karma
Highlighted

Re: Can field values be used as a macro name?

SplunkTrust
SplunkTrust

@stu2's link appears to be missing, so here's the short answer: No.

Slightly longer: Macros are evaluated before the search is run, while field values are known during the execution - too late. Macros are evaluated once per search, while field values exist once per row - too many.

Edit: found the link: http://answers.splunk.com/answers/144038/how-can-i-pass-field-value-as-macro-name.html