I have two macros with names yes and no
Now, I want to refer to these macros in my search query, but not by directly calling them with the name
My query looks something like below
...| eval FLAG=if(fieldA!=fieldb,yes,no) | `FLAG`
I want the FLAG field to be substituted with yes or no so that my corresponding macro is called.
With the above approach, I suppose it looks for a macro with the name FLAG.
How can I achieve this?
Macro substitution happens once before the search is started, so it cannot depend on field values.
What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.
Edit: Here's what you can do. Define an eval-based macro
fieldA_or_fieldB(1) like this:
if("$selection$"=="*", "fieldA", "fieldB")
Then change your search to this:
... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`
That'll select fieldA if your token has been set to
*, fieldB otherwise.
Hi Martin, here is my actual requirement.
I have a drop down in my dashboard. I want to change the search query of the panel based on the option selected from drop down.
If * (All) is selected from the drop down my search query should be ...| stats sum(total_amount) by fieldA
If any other value is selected from the drop down, my search query should be ..| stats sum(total_amount) by fieldB
Okay, you can use an eval-based macro to decide the field name - this works because you're not actually deciding based on a field value but rather on a token. That's known and unique before running the search, so the macro substitution works. I've added an example to the answer above.