I have two macros with names yes and no
Now, I want to refer to these macros in my search query, but not by directly calling them with the name
My query looks something like below
...| eval FLAG=if(fieldA!=fieldb,yes,no) | `FLAG`
I want the FLAG field to be substituted with yes or no so that my corresponding macro is called.
With the above approach, I suppose it looks for a macro with the name FLAG.
How can I achieve this?
Macro substitution happens once before the search is started, so it cannot depend on field values.
What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.
Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1)
like this:
if("$selection$"=="*", "fieldA", "fieldB")
Then change your search to this:
... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`
That'll select fieldA if your token has been set to *
, fieldB otherwise.
Macro substitution happens once before the search is started, so it cannot depend on field values.
What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.
Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1)
like this:
if("$selection$"=="*", "fieldA", "fieldB")
Then change your search to this:
... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`
That'll select fieldA if your token has been set to *
, fieldB otherwise.
Perfect. Thanks Martin!
Okay, you can use an eval-based macro to decide the field name - this works because you're not actually deciding based on a field value but rather on a token. That's known and unique before running the search, so the macro substitution works. I've added an example to the answer above.
Other panels in the dashboard as well use the same drop down to filter the data.
Is that the only purpose of the dropdown?
Hi Martin, here is my actual requirement.
I have a drop down in my dashboard. I want to change the search query of the panel based on the option selected from drop down.
If * (All) is selected from the drop down my search query should be ...| stats sum(total_amount) by fieldA
If any other value is selected from the drop down, my search query should be ..| stats sum(total_amount) by fieldB