Knowledge Management

How can I create a Macro with multiple arguments?

raymondc
Engager

Hi

I want to create a macro with at least 1 argument and maximum 20 arguments.
So I created 20 macros. (See example below. I only displayed 3 of them and leaved out some other statements.)

Is there a other way to do this?

Example of my current macros.conf file:

 [get_type(3)]
 args = field_1, field_2, field_3
 definition = ... | where (my_field=$field_1$ OR my_field=$field_2$ OR my_field=$field_3$) | ...

 [get_type(2)]
 args = field_1, field_2
 definition = ... | where (my_field=$field_1$ OR my_field=$field_2$) | ...

 [get_type(1)]
 args = field_1
 definition = ...| where my_field=$field_1$ | ...
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Sure, if you are just passing text values, all destined for testing a single field, then you can pass the argument as a single delimited string, and parse it in the macro. Can't write the parse code off the top of my head, but the call would look like -

 get_type("value_1, value_2, value_3")

Or, you could pass the arguments as an already-configured string like

get_type("my_field=value_1 OR my_field=value_2 OR my_field=value_3")

and just invoke the argument as

| where $arg1$

It seems to me the first method gives a better abstraction barrier, but the second one should work just as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...