Knowledge Management

dropdown token argument to macro argument

surekhasplunk
Communicator

Am using a macro with 1 argument
and while calling it to update my table with values am passing query as mymacro(arg1=*) and it works well.

Now my requirement is arg1 value is coming from dropdown selected value.
So if i have set token as field1 for the dropdown then how to use that as arg1 for macro.

i tried using mymacro(arg1=$field1$) but it isn't working.

Tags (2)
0 Karma

renjith_nair
Legend

@surekhasplunk ,

In macro, you just need to pass the token as mymacro($field1$) where field1 is your token.

Make sure that the argument list and definition of macro matches in terms of number of arguments and variable name

https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Usesearchmacros

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

niketn
Legend

@surekhasplunk, can you add dropdown code XML?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

surekhasplunk
Communicator
<input type="dropdown" token="field1" id="resized_input">
  <label>Business Area</label>
  <prefix>"</prefix>
  <suffix>"</suffix>
  <fieldForLabel>SubDivision 4</fieldForLabel>
  <fieldForValue>SubDivision 4</fieldForValue>
  <search>
    <query>|inputlookup file.csv| dedup  "SubDivision 4" | table "SubDivision 4"</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <choice value="*">ALL</choice>
  <default>*</default>
</input>

My field1 is a string and has got spaces in it.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...