Splunk Search

If i want to create a macro, do i use ' ' or dollar signs?

kimmyb
Loves-to-Learn

when i was studying about macro i sometimes see that we put our arguments between '      ' and sometimes between $    $
does anyone know which we have to use brackets or dollar signs

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you referring to creating a new macro definition with arguments or using a macro with arguments? 

If you are creating a macro with arguments, e.g. my_macro(3) and you want to have arguments

my_arg1, my_arg2, my_arg3

then in the macro SPL you reference those arguments as $my_arg1$ etc.

Note that is different to using $ signs in dashboards where the $ sign is referring to a dashboard token.

 

0 Karma

kimmyb
Loves-to-Learn

Creatieve new query with a macro, So for macro we use dollar signs, correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

as I said, dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

 
 

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...