Splunk Search

Can I use a macro within a macro?

Dimitri_McKay
Splunk Employee
Splunk Employee

Wondering if it's possible to embed a macro into another macro.

Tags (2)
0 Karma

edschembor
Path Finder

See the Splunk documentation for this: http://docs.splunk.com/Splexicon:Searchmacro

Directly from the docs: "You can also nest search macros within each other."

somesoni2
Revered Legend

Yes it is possible.

Here is one example.
Definition

macros.conf

[getCountStatus(1)]
args = count
definition = eval CountStatus=if($count$>100,"Heavy","Light")
iseval = 0

[getRowColorWithCountStatus(1)]
args = count
definition = `getCountStatus($count$)` | eval RowColor=if(CountStatus="Heavy","Read","Green")
iseval = 0

Usage:

index=_internal earliest=-15m@m  | stats count by sourcetype |`getRowColorWithCountStatus(count)`
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...