Knowledge Management

Issue with Macros

theouhuios
Motivator

Hello

I have a very complex search which I want to break into 2 macros. I did create a macro but didn't mention any arguments or anything else other than the name and definition. Can anyone please help me on where I am doing a mistake. I did go through the documentation about arguments but couldn't understand how to define it properly.

Here is the first one

eval mybucket=case(date_hour<4,1,date_hour<8,2,date_hour<12,3,date_hour<16,4,date_hour<20,5,date_hour>0,6) | stats count as I by WG, mybucket,date_mday,date_month,date_year

And the second one is

delta I as D  | eval D = abs(D) | eventstats avg(I) as xbar, avg(D) as mbar by WG | eval threshold = xbar + (2.66*mbar) | eval threshold=coalesce(threshold,0) | dedup WG | fields WG threshold | table WG threshold

Do I need to mention any arguments or give any validation? I did check the use eval-based definition box though. Any help?

Regards

theou

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes, you need to specify arguments. Here is a linear tread macro:

eventstats count as numevents sum($x$) as sumX sum($y$) as sumY sum(eval($x$*$y$)) as sumXY sum(eval($x$*$x$)) as sumX2 sum(eval($y$*$y$)) as sumY2 | eval slope=((numevents*sumXY)-(sumX*sumY))/((numevents*sumX2)-(sumX*sumX)) | eval yintercept=
(sumY-(slope*sumX))/numevents | eval newY=(yintercept + (slope*$x$)) | eval R=((numevents*sumXY) - (sumX*sumY))/sqrt(((numevents*sumX2)-(sumX*sumX))*
((numevents*sumY2)-(sumY*sumY))) | eval R2=R*R

Under 'Argument' on the macro definition page i have x,y as my arguments. You'll see them in the macro definition above surrounded by $ signs like $x$. When i call this from the search will look like this - `lineartrent(arg1,arg2)` and the args will get pass into the macro for you. You can then reference fields created or that exist in your macro and use them in further searches or pass them onto another macro etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...