topic Is there an SPL command using REST to list the macros contained within a macro? in Getting Data In

Is there an SPL command using REST to list the macros contained within a macro?

kdwsplunk — Tue, 29 Sep 2020 17:30:10 GMT

Hello, I see that we can use SPL to get a list of arguments, "args", of a macro using the "rest" command.

| rest /services/configs/conf-macros

It would be great to be able to list all the dependencies of a macro.

In particular, is there a way to use the "rest" command to get a list of macros depended upon by another macro?

For instance, is it possible to get the following output? (See the third column "macros_called_by_macro".)

|---- args ----|---- title ----|---- macros_called_by_macro ---| --- author --- | --- definition --- |
|              |     macro_01  |    macro_02, macro_03         |
|              |     macro_02  |    macro_04                   |
|              |     macro_03  |                               |

Thanks so much!!!

Re: Is there an SPL command using REST to list the macros contained within a macro?

DalJeanis — Fri, 05 Jan 2018 22:22:23 GMT

Try this...

| rest /services/configs/conf-macros 
| rex field=definition max_match=0 "\`(?<themacros>[^\`\(]*)[\`\(]" 
| rex field=id "(?<title>[^\/]*)$"
| table args title them* author definition

Then, depending on what you want to do next, you could put commas between the multiple values...

| eval themacros=mvjoin(themacros,", ")

Re: Is there an SPL command using REST to list the macros contained within a macro?

somesoni2 — Fri, 05 Jan 2018 22:39:38 GMT

AFAIK, there are no such rest end point, not event for other knowledge objects (e.g. saved searches, dashboards etc) which will list dependencies. The rest queries just give details about current object. You probably have to parse it's definition to find any other macro invocation and then run some stats to get the table you expect.

Re: Is there an SPL command using REST to list the macros contained within a macro?

kdwsplunk — Thu, 18 Jan 2018 18:09:11 GMT

Thank you for your suggestion. ...Great approach!

I tried it and found that the REGEX on line #2 above just needs an adjustment because sometimes it grabs more than just the macro name. I'm currently getting up-to-speed on REGEX so that I can post an adjustment. I only have a partial suggestion at the moment. This suggestion grabs the macro name as well as the macro argument:

2. | rex field=definition max_match=0 "\`(?<themacros>[^`]*)\`"

I would like to figure out how to get rid of the argument (that is, the parentheses that follow the macro name, as well as the contents of the parentheses.

For example, the current result is:

macro_name(macro_argument)

But I would like to get the following result:

macro_name

Thank you again for your approach! Very nice!!!

Re: Is there an SPL command using REST to list the macros contained within a macro?

landen99 — Tue, 02 Apr 2019 15:22:35 GMT

`(?<!\)`)(?<macros>[a-zA-Z][^`\(]*)[\(`]