I'm totally lost when it comes to arguments in macros. Here is what I want to do. I have three partial searches that are almost identical.
sourcetype="iis" cs_username!="-" /TM/ .pdf
sourcetype="iis" cs_username!="-" /TD/ .pdf
sourcetype="iis" cs_username!="-" /TDB/ .pdf
I would like to turn this into a macro where I can pass the argument for the values between the slashes. For the life of me I can't figure out what my macro should look like or how to call it. The documentation on macros really stinks.
Hi kmattem,
You want a single parameter macro, with one argument:
macros.conf
[iis_search(1)]
args = fragment
definition = sourcetype="iis" cs_username!="-" /$fragment$/ .pdf
And call it like so
`iis_search(fragment=TM)`
Hi kmattem,
You want a single parameter macro, with one argument:
macros.conf
[iis_search(1)]
args = fragment
definition = sourcetype="iis" cs_username!="-" /$fragment$/ .pdf
And call it like so
`iis_search(fragment=TM)`
If you do this through the user interface, fill in the form as follows:
In the Name box, enter iis_search(1)
Under Definition, enter sourcetype="iis" cs_username!="-" /$fragment$/ .pdf
Under Arguments, enter fragment