Extending Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 154

Be sure to remove newlines from your search definition. Macros do
not appear to work with embedded newlines.
Walking through our fields, we have:
• Name : This is the name we will use in our searches. The parentheses and
integer (2) specify how many arguments this macro expects.
• Definition: : We have defined the entire query in this case. The variables
are defined as $user$ and $maxpause$ . We can use these names because
we have defined the variables under Arguments .
• Arguments : This list assigns variable names to the values handed in to
the macro.
After clicking on Save , our macro is now available for use. We can use it like this:
webtransactions_user_maxpause(mary,5m)
or
`webtransactions_user_maxpause("mary","5m")`
Using eval to build a macro
We will use this feature in conjunction with a workflow action later in this chapter.
See the Building a workflow action to show field context section later in this chapter.
Creating workflow actions
Workflow actions allow us to create custom actions based on the values in search
results. The two supported actions either run a search or link to a URL.