Splunk Search

Can field values be used as a macro name?

mrain7
New Member

Can be used as a macro name field value?

EX)

index=_internal | table sourcetype | `sourcetype`

I have a 500 type
I want to use each type of each macro.

What should I do?

Tags (4)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

@stu2's link appears to be missing, so here's the short answer: No.

Slightly longer: Macros are evaluated before the search is run, while field values are known during the execution - too late. Macros are evaluated once per search, while field values exist once per row - too many.

Edit: found the link: http://answers.splunk.com/answers/144038/how-can-i-pass-field-value-as-macro-name.html

stu2
Explorer
0 Karma

somesoni2
Revered Legend

What is your requirement for creating these macros? you need different processing for each sourcetype?

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...