How can I pass field value as macro name

[pradeepkumarg]

I have two macros with names yes and no

Now, I want to refer to these macros in my search query, but not by directly calling them with the name

My query looks something like below

...| eval FLAG=if(fieldA!=fieldb,yes,no) | `FLAG`

I want the FLAG field to be substituted with yes or no so that my corresponding macro is called.

With the above approach, I suppose it looks for a macro with the name FLAG.

How can I achieve this?

[martin_mueller · Accepted solution]

Macro substitution happens once before the search is started, so it cannot depend on field values.

What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.

Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1) like this:

if("$selection$"=="*", "fieldA", "fieldB")

Then change your search to this:

... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`

That'll select fieldA if your token has been set to *, fieldB otherwise.

[pradeepkumarg]

Perfect. Thanks Martin!

[martin_mueller]

Okay, you can use an eval-based macro to decide the field name - this works because you're not actually deciding based on a field value but rather on a token. That's known and unique before running the search, so the macro substitution works. I've added an example to the answer above.

[pradeepkumarg]

Other panels in the dashboard as well use the same drop down to filter the data.

[martin_mueller]

Is that the only purpose of the dropdown?

[pradeepkumarg]

Hi Martin, here is my actual requirement.

I have a drop down in my dashboard. I want to change the search query of the panel based on the option selected from drop down.

If * (All) is selected from the drop down my search query should be ...| stats sum(total_amount) by fieldA

If any other value is selected from the drop down, my search query should be ..| stats sum(total_amount) by fieldB