Splunk Search

If i want to create a macro, do i use ' ' or dollar signs?

kimmyb
Loves-to-Learn

when i was studying about macro i sometimes see that we put our arguments between '      ' and sometimes between $    $
does anyone know which we have to use brackets or dollar signs

Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you referring to creating a new macro definition with arguments or using a macro with arguments? 

If you are creating a macro with arguments, e.g. my_macro(3) and you want to have arguments

my_arg1, my_arg2, my_arg3

then in the macro SPL you reference those arguments as $my_arg1$ etc.

Note that is different to using $ signs in dashboards where the $ sign is referring to a dashboard token.

 

0 Karma

kimmyb
Loves-to-Learn

Creatieve new query with a macro, So for macro we use dollar signs, correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

as I said, dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

 
 

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...