Which of the following searches show a valid use of macro? (Select all that apply)

The correct answer is A. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time. To use a macro in a search, you must enclose the macro name and any arguments in single quotation marks. For example, 'my_macro(arg1,arg2)' is a valid way to use a macro with two arguments. You can use macros anywhere in your search string where you would normally use a search…

Creating and Using Macros

Question

Options

Aindex=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
Bindex=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
Cindex=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time
Dindex=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time

How the community answered

(16 responses)

A
75% (12)
B
6% (1)
D
19% (3)

Explanation

To use a macro in a search, you must enclose the macro name and any arguments in single quotation marks. For example, 'my_macro(arg1,arg2)' is a valid way to use a macro with two arguments. You can use macros anywhere in your search string where you would normally use a search command or expression. Therefore, options A and C are valid searches that use macros, while options B and D are invalid because they do not enclose the macros in single quotation

Topics

#Splunk macros#Macro syntax#SPL#Search commands

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice