Splunk Search

How to call macros from a Splunk JavaScript SDK search?

ektasiwani
Communicator

Hi,

In my search, I need to call a macro with the eval command, but I am getting error "bad request".
My macros.conf file is inside an app and I have given that app global permission.

[calc_score]
definition = case( $score$=40,"pass", $score$=70,"average", $score$=90,"good")
args = score

I am trying to call this macro using JavaScript SDK search:

.. |  eval Severity=`calc_score(score=fieldname)`

I tried adding search before macro name, but no use, something like this :

.. |  eval Severity=search `calc_score(score=fieldname)

Is this the wrong way to call macros using the JavaScript SDK?

Any help is appreciated.

Thanks

0 Karma
1 Solution

ektasiwani
Communicator

Hi ,

I found solution.

I gave global permission to macros.conf file separately in "metadata/local.meta" and replaced:

 .. |  eval Severity= 'calc_score(score=fieldname)'  

with

.. |  eval Severity=`calc_score(score=fieldname)` 

and it started working.

Hope this helps others.

View solution in original post

0 Karma

ektasiwani
Communicator

Hi ,

I found solution.

I gave global permission to macros.conf file separately in "metadata/local.meta" and replaced:

 .. |  eval Severity= 'calc_score(score=fieldname)'  

with

.. |  eval Severity=`calc_score(score=fieldname)` 

and it started working.

Hope this helps others.

0 Karma

ektasiwani
Communicator

Hi aljohnson ,

Yes search works fine without macro.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Can you verify the search works w/o the macro?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...