Splunk Search

How to pass key & value array into macro?

koshyk
Super Champion

Just checking if there is a smart way of passing "key" and "value" (ideally key-value array) into a macro

Ideally i'm looking for

## mykeyValueArray={key1:value1, key2:value2} 
[my_macro(1)]
args = mykeyValueArray
definition = index=abc sourcetype=xyz  $mykeyValueArray$

or atleast something like below as a baby-step

[my_macro(2)]
args = mykey,myvalue
definition = index=abc sourcetype=xyz  $mykey$=$myvalue$

we need to dynamically pass keys & values into the macro

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The latter method should work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The latter method should work.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...