Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command. Macros inside of quoted values are not expanded.
I'm I the only one that see there's no "NewField" in the A search and that would likely result in the search not working.
For me only C is working in terms of macro's and search.
But maybe I'm wrong.
Only A is correct
B is incorrect since the if statement was malformed
C is incorrect since the field value must be quoted by double-quotes, not single-quotes
D is incorrect obviously
I think the only answer is A based off what I read here: https://community.splunk.com/t5/Knowledge-Management/How-to-pass-field-values-as-macro-arguments/m-p/164018
BD are for sure incorrect (improper use of back ticks (D) and no function following stats command (B))
C however, I think is also wrong because eval evaluates mathematical, string, and boolean expressions.. therefore eval newField='makeMyField(oldField)' would take oldField as a string and not as an argument.
Not Sure what does D do ?
I think A & C are correct.
| eval n=`tostringnumber(15)` where as the macro is tostring($number$, "hex") , If I understood the option C correctly , this works.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Powdered_Sugar
Highly Voted 3 years, 6 months agoSteve2610
1 year, 10 months agoSteve2610
1 year, 10 months agoTeloif
Most Recent 7 months agoDree_Dogg
9 months, 3 weeks agopoubellelc66
11 months, 3 weeks agomohanmk95
1 year, 1 month agoHarrysa
1 year, 1 month agoTestingAccount900
1 year, 8 months agohuu_nguyen
2 years, 4 months agoIman1367
2 years, 8 months agoM9201715
2 years, 8 months agoHudda
2 years, 10 months agoLalithadevi
3 years, 2 months agoIxlJustinlxl
3 years, 4 months agosubham29
2 years, 4 months ago_pasha
3 years, 5 months agoakkki
3 years, 8 months agonirmaljohnson
3 years, 6 months agokbisht
3 years, 9 months ago