Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

A . Convert_sales (euro, , 79)”
B . Convert_sales (euro, , .79)
C . Convert_sales ($euro,$$,s79$
D . Convert_sales ($euro, $$,S,79$)

View Answer

Answer: B

Explanation:

Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros

The correct way to execute the macro in a search string is to use the format macro_name($arg1$, $arg2$, …) where $arg1$, $arg2$, etc. are the arguments for the macro. In this case, the macro name is convert_sales and it takes three arguments: currency, symbol, and rate. The arguments are enclosed in dollar signs and separated by commas. Therefore, the correct way to execute the macro is convert_sales($euro$, $$, .79).