Splunk Search

If i want to create a macro, do i use ' ' or dollar signs?

kimmyb
Loves-to-Learn

when i was studying about macro i sometimes see that we put our arguments between '      ' and sometimes between $    $
does anyone know which we have to use brackets or dollar signs

Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you referring to creating a new macro definition with arguments or using a macro with arguments? 

If you are creating a macro with arguments, e.g. my_macro(3) and you want to have arguments

my_arg1, my_arg2, my_arg3

then in the macro SPL you reference those arguments as $my_arg1$ etc.

Note that is different to using $ signs in dashboards where the $ sign is referring to a dashboard token.

 

0 Karma

kimmyb
Loves-to-Learn

Creatieve new query with a macro, So for macro we use dollar signs, correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

as I said, dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

 
 

gcusello
SplunkTrust
SplunkTrust

Hi @kimmyb,

dollar signs are used for tokens, brachets or quotes are used for strings or some field names.

Macros use a special sign "`" that you can display typing <alt>096.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...