Splunk Search

Can field values be used as a macro name?

mrain7
New Member

Can be used as a macro name field value?

EX)

index=_internal | table sourcetype | `sourcetype`

I have a 500 type
I want to use each type of each macro.

What should I do?

Tags (4)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

@stu2's link appears to be missing, so here's the short answer: No.

Slightly longer: Macros are evaluated before the search is run, while field values are known during the execution - too late. Macros are evaluated once per search, while field values exist once per row - too many.

Edit: found the link: http://answers.splunk.com/answers/144038/how-can-i-pass-field-value-as-macro-name.html

stu2
Explorer
0 Karma

somesoni2
Revered Legend

What is your requirement for creating these macros? you need different processing for each sourcetype?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...