Splunk Search

Macro with a macro-name-argument

SonnyB
Explorer

Can a macro be defined, that takes another string as the name of the macro, which gets ‘eval’ed first based on the eventdata, to yield a set of dynamic arguments, which the hosting-macro finally uses as its real arguments, to transform them and/or derive some result, which can then be fed back into the sourcing eventdata itself as a new-field, which can then be used in the next segment of the original search-pipeline?

0 Karma

woodcock
Esteemed Legend

Yes, you can pass a macroname as an argument to one macro and have the called macro call the passed-in macro.

0 Karma

Ayn
Legend

Care to make that question a bit more readable and possible to follow? 🙂

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...