I made macros.
test_macro1, test_macro2
The macros are the result comes out
But macros will now run in eval case
Query statement
index = main | eval a = case (field> 1, test_macro1
, field == 0, test_macro2
)
Will this query should not run?
Hi mrain7,
no, this will only set the value of a
based on the condition to either test_macro1
or test_macro2
.
But you could build this as macro and provide the where
statement as argument, lets start with a run everywhere example:
index=_internal | eventstats count(sourcetype) as myCount by sourcetype | where myCount<100 | timechart span=1m values(myCount) as myCount by sourcetype
this returns the count per sourcetype over time. Now we replace the where
condition with a placeholder like $wherearg$
and create it as macro as described in the docs here and name it count_sourcetype
.
You can now call the marco like this:
`count_sourcetype(myCount<100)
`
and it will use the myCount<100
as condition of where
and returns only results where the count per time range is under 100 events.
hope this helps ...
cheers, MuS