Knowledge Management

Create search macro with return value

yko84109
Loves-to-Learn

Hi,

I want to create my search macro to return new field.
Example:

my_search_macro("1")

I want to return a new field, test, that contains "your value is " + $arg$

What I'm tried to write in search macro definition:

|eval test="your value is " + $arg$

But when I execute my search command as follow:

|makeresults | eval msg = my_search_macro("1") | table msg

I got an error.
So how can I simply create search macro with return value?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Macros are simple text substitutions, not functions. Your example query expands to | makeresults | eval msg = eval test="your value is foo" | table msg, which is why you get an error. Try changing the macro to "your value is " + $arg$ and be sure to check the "eval" box.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...