topic Can a macro be created for an application based on the application setup.xml? in Getting Data In

Can a macro be created for an application based on the application setup.xml?

simpkins1958 — Thu, 14 Apr 2016 18:32:42 GMT

Our server can input data into Splunk either via Syslog or Http Event Collector. In our Splunk application, we want the user to be able to specify which method they are using and then create a macro based on that information. This is to handle our legacy Splunk application that currently only uses syslog. With our next release we are adding Http Event Collector too.

We want to configure setup.xml for our application to define a macro based on user input.

A boolean input for "Use Syslog Data"

In macros.conf file:

[DiagnosticsDataSource(1)]
args = diagnosticsType

if "Use Syslog Data" = true

definition = sourcetype=syslog LocalityServer "$diagnosticsType$"

else

definition = sourcetype= "$diagnosticsType$"

Re: Can a macro be created for an application based on the application setup.xml?

martin_mueller — Thu, 14 Apr 2016 22:09:49 GMT

Have you considered just OR'ing both options statically?

Re: Can a macro be created for an application based on the application setup.xml?

simpkins1958 — Thu, 14 Apr 2016 22:45:05 GMT

Thanks. This works.

Re: Can a macro be created for an application based on the application setup.xml?

martin_mueller — Thu, 14 Apr 2016 23:28:58 GMT

Great. I've converted the comment to an answer, feel free to mark this as accepted if you're happy.