Snippet of search
| eval runmacro = if(deltadif="NO","
| where alertnamecount>0
| where alertnamecount=(count+1)
| where alertnamecount=0
| head 1
| where count=1
| where deltadif = "NO"
The macros exist and the comments above are the exact macros. From the 'deltadif' value I need to perform one of the above macros. This runs successfully, but it appears the macro is not executing. When I run each one inline, they function as expected, but require a unique search for each.
Can a variable be set as a macro and be called; if so how? Or is there a better solution?
Yes, like this:
.... | eval runmacro = if(deltadif="NO","`TurnTimeRecovered`","`TurnTimeWarning`") | map search="search Other Stuff Here | `$runmacro$`"
You can turn this inside-out and do the same thing with a
The 2 templatizing approaches are
That's what I wasn't considering -- running separate search. Thanks for the guidance; it does appear to give me what I'm looking for.