Given the macro definition below, what should be entered into the Name and Arguments fields to correctly configure the macro?
Given the macro definition below, what should be entered into the Name and Arguments fields to correctly configure the macro?
To correctly configure the macro, you need to include the number of arguments in parentheses after the macro name. This is specified by the format sessiontracker(2), indicating that the macro takes two arguments. The arguments, which are action and JSESSIONID, should be listed without the dollar signs which are only used in the macro definition itself. Therefore, the macro name should be sessiontracker(2) and the arguments should be action, JSESSIONID.
B is correct.
B is the correct answer. If your macro have arguments you must specify them in parenthesis after the macro name (like <macroname>(<numberofarguments>)) When you specify the arguments you have to tell splunk what are the arguments name (without the $).
B Is correct Answer
B is the correct answer, see p213 of f2
B Is correct Answer
And why it is not A? I mean there is nothing about macro name in that screen.
Nevermind I just realized that it is number of arguments.