Take a look at this example showing how you can parameterize a search macro:
Example - Combine search macros and transactions
So try defining your macro 'foo(4)' like this:
sourcetype="log-file-pub" $msg1$ OR $msg2$ OR $msg3$ OR $msg4$
And remember to specify your arguments in the Arguments list:
msg1,msg2,msg3,msg4
Then reference the macro like this:
` foo("bar1","bar2","bar3","bar4") `
... or with your specified messages:
` foo("market data retrieval failed","The request failed with HTTP status 503: Service Unavailable","Error getting market data","The request failed with HTTP status 403: Forbidden") `
Also, if you want to preserve the literal quotations marks, then either define your macro with quotes around the args:
sourcetype="log-file-pub" "$msg1$" OR "$msg2$" OR "$msg3$" OR "$msg4$"
... or pass the quotes when using the macro:
` foo("\"bar1\"","\"bar2\"","\"bar3\"","\"bar4\"") `
... View more
