Skip to content

Commit 9e1742d

Browse files
authored
Update macro.md
1 parent c9fc3a2 commit 9e1742d

File tree

1 file changed

+20
-3
lines changed
  • docs/search/search-query-language/search-operators

1 file changed

+20
-3
lines changed

docs/search/search-query-language/search-operators/macro.md

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ To create a macro, follow the steps below:
4040
### Limitations
4141

4242
- You can create a maximum of 50 macros.
43-
- You can add a maximum of 5 definitions.
43+
- You can add a maximum of 5 arguments.
4444

45-
### Example
45+
### Example without arguments
4646

4747
Consider the below query, which searches for errors with `timeslice` of 5 minutes.
4848

@@ -55,4 +55,21 @@ Now, by creating a macro for the `timeslice` field, the query using the `macro`
5555

5656
```
5757
_sourceCategory=error | `timeslice_macro`
58-
```
58+
```
59+
60+
### Example with arguments
61+
62+
Consider the below query, which searches for errors with `timeslice` for time of your choice.
63+
64+
```
65+
_sourceCategory=error | timeslice 5m
66+
| count by _timeslice
67+
```
68+
69+
To create a macro that allows you to enter a value of your choice, we use arguments during the macro creation process. You may choose to include validation conditions within these arguments. If validation conditions are present, make sure to specify the correct data type for <arg1_value> to achieve the desired results.
70+
71+
The following is a simplified version of the query that uses the macro operator with arguments. Replace `<arg1_value>` with the value of your choice.
72+
73+
```
74+
_sourceCategory=error | `timeslice_macro(<arg1_value>)`
75+
```

0 commit comments

Comments
 (0)