Splunk Search

How can I pass field value as macro name

pradeepkumarg
Influencer

I have two macros with names yes and no

Now, I want to refer to these macros in my search query, but not by directly calling them with the name

My query looks something like below


...| eval FLAG=if(fieldA!=fieldb,yes,no) | `FLAG`

I want the FLAG field to be substituted with yes or no so that my corresponding macro is called.

With the above approach, I suppose it looks for a macro with the name FLAG.

How can I achieve this?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Macro substitution happens once before the search is started, so it cannot depend on field values.

What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.

Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1) like this:

if("$selection$"=="*", "fieldA", "fieldB")

Then change your search to this:

... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`

That'll select fieldA if your token has been set to *, fieldB otherwise.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Macro substitution happens once before the search is started, so it cannot depend on field values.

What's in those macros? Maybe there's a different way to achieve whatever it is you're trying to do.

Edit: Here's what you can do. Define an eval-based macro fieldA_or_fieldB(1) like this:

if("$selection$"=="*", "fieldA", "fieldB")

Then change your search to this:

... | stats sum(total_amount) by `fieldA_or_fieldB($your_token$)`

That'll select fieldA if your token has been set to *, fieldB otherwise.

pradeepkumarg
Influencer

Perfect. Thanks Martin!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Okay, you can use an eval-based macro to decide the field name - this works because you're not actually deciding based on a field value but rather on a token. That's known and unique before running the search, so the macro substitution works. I've added an example to the answer above.

0 Karma

pradeepkumarg
Influencer

Other panels in the dashboard as well use the same drop down to filter the data.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is that the only purpose of the dropdown?

0 Karma

pradeepkumarg
Influencer

Hi Martin, here is my actual requirement.

I have a drop down in my dashboard. I want to change the search query of the panel based on the option selected from drop down.

If * (All) is selected from the drop down my search query should be ...| stats sum(total_amount) by fieldA

If any other value is selected from the drop down, my search query should be ..| stats sum(total_amount) by fieldB

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...