Splunk Search

How can I pass field value as macro name

Influencer

I have two macros with names yes and no

Now, I want to refer to these macros in my search query, but not by directly calling them with the name

My query looks something like below


...| eval FLAG=if(fieldA!=fieldb,yes,no) | `FLAG`

I want the FLAG field to be substituted with yes or no so that my corresponding macro is called.

With the above approach, I suppose it looks for a macro with the name FLAG.

How can I achieve this?

1 Solution

SplunkTrust
SplunkTrust

Macro substitution happens once before the search is started, so it cannot depend on field values.

What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.

Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1) like this:

if("$selection$"=="*", "fieldA", "fieldB")

Then change your search to this:

... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`

That'll select fieldA if your token has been set to *, fieldB otherwise.

View solution in original post

SplunkTrust
SplunkTrust

Macro substitution happens once before the search is started, so it cannot depend on field values.

What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.

Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1) like this:

if("$selection$"=="*", "fieldA", "fieldB")

Then change your search to this:

... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`

That'll select fieldA if your token has been set to *, fieldB otherwise.

View solution in original post

Influencer

Perfect. Thanks Martin!

0 Karma

SplunkTrust
SplunkTrust

Okay, you can use an eval-based macro to decide the field name - this works because you're not actually deciding based on a field value but rather on a token. That's known and unique before running the search, so the macro substitution works. I've added an example to the answer above.

0 Karma

Influencer

Other panels in the dashboard as well use the same drop down to filter the data.

0 Karma

SplunkTrust
SplunkTrust

Is that the only purpose of the dropdown?

0 Karma

Influencer

Hi Martin, here is my actual requirement.

I have a drop down in my dashboard. I want to change the search query of the panel based on the option selected from drop down.

If * (All) is selected from the drop down my search query should be ...| stats sum(total_amount) by fieldA

If any other value is selected from the drop down, my search query should be ..| stats sum(total_amount) by fieldB

0 Karma