Splunk Search

If i want to create a macro, do i use ' ' or dollar signs?

kimmyb
Loves-to-Learn

when i was studying about macro i sometimes see that we put our arguments between '      ' and sometimes between $    $
does anyone know which we have to use brackets or dollar signs

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you referring to creating a new macro definition with arguments or using a macro with arguments? 

If you are creating a macro with arguments, e.g. my_macro(3) and you want to have arguments

my_arg1, my_arg2, my_arg3

then in the macro SPL you reference those arguments as $my_arg1$ etc.

Note that is different to using $ signs in dashboards where the $ sign is referring to a dashboard token.

 

0 Karma

kimmyb
Loves-to-Learn

Creatieve new query with a macro, So for macro we use dollar signs, correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

as I said, dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

 
 

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...