topic Re: How to pass an argument to a macro and execute this macro repeatedly using "by source"? in Getting Data In

How to pass an argument to a macro and execute this macro repeatedly using "by source"?

tac24 — Tue, 29 Sep 2020 08:56:16 GMT

Hi,

I would like to execute macro_with_args repeatedly using by source. How can I pass the arg_value to the macro?

Context: syslog-like events from over thousands sites for a given time range are saved in each site-source-file. As a whole, …zip file is added to Splunk. For one site-source-file, I made search series and got a desired result (a), then defined the macro_with_args by extracting a core search series from (a) as (b). The defined macro was tested alone and got the same result as (a) did.

(a)

index=… sourcetype=… source=specific-file-name-within…zip-file | series of search  |  stats  perc50(X) dc(Y)  values(Z)

(b)

macro name: perSITEinfo_with_args(1)
definition: search source=$in_source$ | series of search | stats perc50(X) dc(Y) values(Z)
args: in_source

As a new search, I expected the following search (c) work, but got no results:

(c)

index=…  sourcetype=…   | `perSITEinfo_with_args(source)` by source

Q1: How can I pass the arg_value to the macro?
Q2: Does this approach (macro call repeatedly) work?
If not, what is another approach? Sub search?
It is appreciated if a “transformation” way from macro approach to another approach were explained.

Re: How to pass an argument to a macro and execute this macro repeatedly using "by source"?

fdi01 — Tue, 29 Sep 2020 08:55:06 GMT

try like
(c) index=… sourcetype=… | perSITEinfo_with_args(specific-file-name-source-within…zip-file) by source

or
definition: search index=… sourcetype=… $in_source$ | series of search | stats perc50(X) dc(Y) values(Z) by source

after run with source=specific-file-name-source args like this :
perSITEinfo_with_args(source=specific-file-name-within…zip-file)

Re: How to pass an argument to a macro and execute this macro repeatedly using "by source"?

tac24 — Sat, 27 Feb 2016 01:00:11 GMT

Hi, fdi01, thanks for your answer.
I tried your two solutions, unfortunately, they did not work.

Re: How to pass an argument to a macro and execute this macro repeatedly using "by source"?

DalJeanis — Thu, 05 Jan 2017 20:30:31 GMT

If the "series of search" is the same for all different sources, then you don't need a macro, although you could build one for the "source=" list below. Try this -

  index=…  sourcetype=…  (source=filename1withinzip OR source=filename1withinzip OR source=filename1withinzip ...) | series of search | stats perc50(X) dc(Y) values(Z) by source