topic Re: Can we write a Python or JS to update macros.conf? in Splunk Dev

Can we write a Python or JS to update macros.conf?

meenal901 — Mon, 18 May 2015 12:26:43 GMT

I have a lookup file which gets updated daily. Based on this, I want to update my macro as well.
e.g.: The Lookup contains fields: Exception, Ticket No, Description
I want to take Exception field, escape-sequence all ( and [, replace \r\n by | and put these values in another macro which i am using on another app.

Can this be done using a Python custom command or JS? The escape sequence and replacing, probably I can do using SPL itself. The script should just update macros.conf.

Another alternative is to write a shell script, but trying from Splunk before I go that route.

Thanks,
Meenal

Re: Can we write a Python or JS to update macros.conf?

meenal901 — Mon, 28 Sep 2020 20:05:03 GMT

More information:

Updating macros.conf from lookup. Below is my macro query and lookup definition, (only first 2 rows, i have 50 currently and expected to grow 150+) which I want to update from a scheduled search, rather than manually. Can we construct something in python? Shell script is another alternative, but if we can write a command for this, then it would be great. This is 1 case, if we can create something, would be applicable to atleast 2 more places. Also, this lookup file is updated at least 2 times every week. So automation can be really helpful for Splunk.

Lookup:
PITS_Number,PITS_Exception,Status,Cluster_Type,Priority
194458,NoSuchPropertyException caught in ProductMaintenanceServiceImpl,Open,Global Cluster,High
237666,Unknown/unsupported Order format1 message type,Open,Business Cluster,Medium

Macro:

index=cboe_* splunk_server=* | rex field=_raw "(?<PITS_194458>NoSuchPropertyException caught in ProductMaintenanceServiceImpl)"|rex field=_raw "(?<PITS_237666>Unknown/unsupported Order format1 message type)"| eval PITS_Number1=if(PITS_194458!="",194458,"")|eval PITS_Number2=if(PITS_237666!="",237666,"")|eval PITS_Exception=mvappend(PITS_194458,PITS_237666)|search PITS_Exception!=""| eval PITS_Number=mvappend(PITS_Number1,PITS_Number2)| lookup PITS.csv PITS as PITS_Number OUTPUT PITS as PITS, Exception as PITS_Exception_Pattern,Cluster_Type as Cluster,Priority as Priority,Status as Status

Re: Can we write a Python or JS to update macros.conf?

Arun_N_007 — Wed, 27 May 2015 04:52:27 GMT

You cant alter macros.conf without using SDKs.

But you can save the query in a lookup instead of macro and modify it as per lookup changes. And in using map command (But it can return only 10K records) invoke the modified query.

Re: Can we write a Python or JS to update macros.conf?

meenal901 — Tue, 02 Jun 2015 09:16:13 GMT

Python is not required. Any Macro is exposed as a REST end-point, and using curl command, it can be updated.
I finally used combination of search query (to prepare content of macro), scheduled it as alert and on alert wrote a simple shell script by using ARG8 provided by splunk, to write it in macros.conf by curl command.

Re: Can we write a Python or JS to update macros.conf?

meenal901 — Tue, 11 Aug 2015 06:02:57 GMT

Answering my own question 🙂

Re: Can we write a Python or JS to update macros.conf?

forum4lifeson — Wed, 02 Sep 2015 19:04:03 GMT

What did you do in your curl command to make it work. I am trying to update macro definitions using curl in the xml and failing.

Re: Can we write a Python or JS to update macros.conf?

rsathish47 — Wed, 22 Mar 2017 18:11:55 GMT

Hi Meenal,
Is possible to provide me the sample/example code ?

Thanks
Sathish Rangan

Re: Can we write a Python or JS to update macros.conf?

rsathish47 — Wed, 22 Mar 2017 19:07:37 GMT

https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html
i got it 🙂