Hi. I wanted to use a macro to call a different macro based on the parameter and the definition of the sub-macro is from the "tstats" command. For example,
[parentMacro(1)]
args=source
definition=CASE($source$="xyz", `childMacro_xyz`, $source$="abc", `childMacro_abc`)
[childMacro_xyz]
definition= tstats count WHERE index=blah where source="xyz"
[childMacro_abc]
definition= tstats count WHERE index=blah where source="abc"
I got "Search Factory: Unknown search command 'case'" while using the following
| makeresults
| eval source="xyz"
|`parentMacro(source)`
Any clues? Thanks.
| search`parentMacro(source)`
?
Or include the search command in the macro, although that might only fix the first issue I can see there...