Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command. Macros inside of quoted values are not expanded.
I'm I the only one that see there's no "NewField" in the A search and that would likely result in the search not working.
For me only C is working in terms of macro's and search.
But maybe I'm wrong.
Only A is correct
B is incorrect since the if statement was malformed
C is incorrect since the field value must be quoted by double-quotes, not single-quotes
D is incorrect obviously
I think the only answer is A based off what I read here: https://community.splunk.com/t5/Knowledge-Management/How-to-pass-field-values-as-macro-arguments/m-p/164018
BD are for sure incorrect (improper use of back ticks (D) and no function following stats command (B))
C however, I think is also wrong because eval evaluates mathematical, string, and boolean expressions.. therefore eval newField='makeMyField(oldField)' would take oldField as a string and not as an argument.
Not Sure what does D do ?
I think A & C are correct.
| eval n=`tostringnumber(15)` where as the macro is tostring($number$, "hex") , If I understood the option C correctly , this works.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Powdered_Sugar
Highly Voted 3 years agoSteve2610
1 year, 5 months agoSteve2610
1 year, 5 months agoTeloif
Most Recent 1 month, 3 weeks agoDree_Dogg
4 months, 2 weeks agopoubellelc66
6 months, 1 week agomohanmk95
8 months agoHarrysa
8 months, 3 weeks agoTestingAccount900
1 year, 3 months agohuu_nguyen
1 year, 11 months agoIman1367
2 years, 2 months agoM9201715
2 years, 2 months agoHudda
2 years, 5 months agoLalithadevi
2 years, 9 months agoIxlJustinlxl
2 years, 11 months agosubham29
1 year, 11 months ago_pasha
2 years, 11 months agoakkki
3 years, 2 months agonirmaljohnson
3 years, 1 month agokbisht
3 years, 3 months ago