Splunk Search

Search Marcro - Sending Results to Macro Variable.

chrisboy68
Contributor

Hi, I'm having the hardest time trying to figure out how to pass an event field into a variable argument to be used in a macro. 

This is my test_macro accepting one argument. 

 

| eval $sub_arg$=subject | sendemail to="myemail address" format="html" server="myserver address" use_tls=1 subject= $sub_arg$

 

 

Test SPL :

|  makeresults 
|  eval subject = "Test Subject"
 `test_macro(subject)`

 

The subject comes into / validated to "subject" and not "Test Subject". What am I doing wrong?

Thank you!

Chris 

Tags (1)
0 Karma

chrisboy68
Contributor

Neither work." test_macro($subject$)`", sends the literal string "$subject$" and the other fails to run.

0 Karma

me74fhfd
Path Finder

alternatively:

| makeresults
| eval subject = "Test Subject"
| `test_macro($subject$)`

0 Karma

me74fhfd
Path Finder

Can you please try this:

| makeresults
| `test_macro(subject="Test Subject")`

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...