How to use macros to search data and persist data?

[jamin358]

I'm creating a bunch of status dashboards where I need to search for a specific set of hosts and persist a result (adding null value later)

I want to use the same macros to keep my search sizes down.

I want to have searches that look like this 

index=main host IN (`listofhosts`) 
| do some filtering 
| append [| makeresults | eval host = "`listofhosts`" | eval state=0 | makemv delim="," host | mvexpand host | fields host state] 
| stats first(*) AS * by host 
| do some more cool stuff

 I know that my hosts don't have spaces in them, so I figure I can write `listofhosts` as

host1,host2,host3,host4

without quotes so the host search at the top will work. But "`listofhosts`" does call the macro (because its in a string).

So, is there any way to call a macro within the body of a string?

[richgalloway]

You don't need to invoke the macro from within a string.  Just build a quoted string around the macro.

| eval host = "\"" . `listofhosts` . "\""

[jamin358]

Unfortunately this work

| makeresults | eval host="\"" . `hostlist` . "\"" | makemv delim="," host | mvexpand host | fields host

macro: `hostlist` = host1,host2,host3,host4

Error: "Field 'host' does not exist in the data"

[richgalloway · Accepted solution]

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

eval host=`hostlist`

becomes

| eval host=host1,host2,host3

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host