Knowledge Management

macro - how to run macro in eval case

mrain7
New Member

I made ​​macros.

test_macro1, test_macro2

The macros are the result comes out

But macros will now run in eval case

Query statement

index = main | eval a = case (field> 1, test_macro1, field == 0, test_macro2)

Will this query should not run?

Tags (1)
0 Karma

MuS
Legend

Hi mrain7,

no, this will only set the value of a based on the condition to either test_macro1 or test_macro2.
But you could build this as macro and provide the where statement as argument, lets start with a run everywhere example:

index=_internal | eventstats count(sourcetype) as myCount by sourcetype | where myCount<100 | timechart span=1m values(myCount) as myCount by sourcetype

this returns the count per sourcetype over time. Now we replace the where condition with a placeholder like $wherearg$ and create it as macro as described in the docs here and name it count_sourcetype.

You can now call the marco like this:

`count_sourcetype(myCount<100)`

and it will use the myCount<100 as condition of where and returns only results where the count per time range is under 100 events.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...