Solved: Conditional Macros - Splunk Community

Splunk Search

Hi,

In view of this answer it is not possible to put a macro in a yew, but is it still valid?

https://community.splunk.com/t5/Splunk-Search/Conditional-Macros/mp/194852

Thank you in advance

1 Solution

Solution

Problem solved 🙂

My macro

[| makeresults | eval rare=$search$ | return $rare]

View solution in original post

Solution

Problem solved 🙂

My macro

[| makeresults | eval rare=$search$ | return $rare]

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...