Splunk Search

If i want to create a macro, do i use ' ' or dollar signs?

kimmyb
Loves-to-Learn

when i was studying about macro i sometimes see that we put our arguments between '      ' and sometimes between $    $
does anyone know which we have to use brackets or dollar signs

Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you referring to creating a new macro definition with arguments or using a macro with arguments? 

If you are creating a macro with arguments, e.g. my_macro(3) and you want to have arguments

my_arg1, my_arg2, my_arg3

then in the macro SPL you reference those arguments as $my_arg1$ etc.

Note that is different to using $ signs in dashboards where the $ sign is referring to a dashboard token.

 

0 Karma

kimmyb
Loves-to-Learn

Creatieve new query with a macro, So for macro we use dollar signs, correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

as I said, dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

 
 

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...