Am using a macro with 1 argument
and while calling it to update my table with values am passing query as mymacro(arg1=*)
and it works well.
Now my requirement is arg1 value is coming from dropdown selected value.
So if i have set token as field1 for the dropdown then how to use that as arg1 for macro.
i tried using mymacro(arg1=$field1$)
but it isn't working.
@surekhasplunk ,
In macro, you just need to pass the token as mymacro($field1$)
where field1 is your token.
Make sure that the argument list and definition of macro matches in terms of number of arguments and variable name
https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Usesearchmacros
@surekhasplunk, can you add dropdown code XML?
<input type="dropdown" token="field1" id="resized_input">
<label>Business Area</label>
<prefix>"</prefix>
<suffix>"</suffix>
<fieldForLabel>SubDivision 4</fieldForLabel>
<fieldForValue>SubDivision 4</fieldForValue>
<search>
<query>|inputlookup file.csv| dedup "SubDivision 4" | table "SubDivision 4"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">ALL</choice>
<default>*</default>
</input>
My field1 is a string and has got spaces in it.