Macros

args = <string>,<string>,...

• A comma-separated string of argument names.
• Argument names can only contain alphanumeric characters, underscores '_', and
  hyphens '-'.
• If the stanza name indicates that this macro takes no arguments, this
  setting is ignored.
• This list cannot contain any repeated elements.

マクロで使用する引数を定義する。

---

definition = <string>

• The string that the macro will expand to, with the argument substitutions
  made. (The exception is when iseval = true, see below.)
• Arguments to be substituted must be wrapped by dollar signs ($). For example:
  "the last part of this string will be replaced by the value of argument foo $foo$".
• Splunk software replaces the $<arg>$ pattern globally in the string, even
  inside of quotes.

マクロの展開後のサーチ分を定義する。また、argsにて定義した引数は"$"で囲んで用いる。

---

validation = <string>

• A validation string that is an 'eval' expression. This expression must
  evaluate to a boolean or a string.
• Use this setting to verify that the macro's argument values are acceptable.
• If the validation expression is boolean, validation succeeds when it returns
  true. If it returns false or is NULL, validation fails and Splunk software
  returns the error message defined by the 'errormsg' setting.
• If the validation expression is not boolean, Splunk software expects it to
  return a string or NULL. If it returns NULL, validation is considered a success.
  Otherwise, the string returned is the error string.

引数の検証をおこなう。
複雑な条件も、結果が１つのTFで返ってくるように定義すれば可能。

---

errormsg = <string>

• The error message to be displayed if validation is a boolean expression and
  it does not evaluate to true.

validationにおいて、結果がfalseであった場合に表示するエラーメッセージを記載する。

---

iseval = true|false

• If "true", the definition attribute is expected to be an eval expression that
  returns a string representing the expansion of this macro.
• Default: false.

trueにすると、""で囲まずに値を返す模様(要検証)

---

description = <string>

• OPTIONAL. A simple english description of what the macro does.

マクロについての説明を記載する。