topic Re: Possible to create search macro using Arguments for a user list? in Knowledge Management

Possible to create search macro using Arguments for a user list?

jwalzerpitt — Thu, 13 Oct 2016 13:42:28 GMT

I have a search that references 80 users in username field:

index=abc EventID=4625 (username=abc OR username=def OR ...)

Is it possible to create a macro with the usernames listed as arguments?

Thx

Re: Possible to create search macro using Arguments for a user list?

ddrillic — Thu, 13 Oct 2016 14:00:47 GMT

The documentation at Define search macros in Settings
explains -

-- 7.(Optional) Provide Arguments as appropriate for your search macro. This is a comma-delimited string of argument names without repeated elements. Argument names may only contain alphanumeric characters (a-Z, A-Z, 0-9), underscores, and dashes.

Re: Possible to create search macro using Arguments for a user list?

gcusello — Thu, 13 Oct 2016 14:03:25 GMT

Use a lookup:

index=abc EventID=4625 [ |inputlookup users.csv | table username] | ...

You could manually manage your lookup or update it using a scheduled search and outputlookup command.
You have only to put attention to the name of the lookup column (username): must be the same of your search field (username), otherwise rename it in subsearch.
if the search to generate the lookup isn't too slow, you could also use a subsearch:

index=abc EventID=4625 [ search index=myindex | dedup username | table username]

Bye.
Giuseppe

Re: Possible to create search macro using Arguments for a user list?

jwalzerpitt — Thu, 13 Oct 2016 14:06:30 GMT

Would the search macro look like as follows?

index=abc EventID=4625 username=$arg1$

Also, are the arguments (username) treated as OR?

Thx

Re: Possible to create search macro using Arguments for a user list?

jwalzerpitt — Thu, 13 Oct 2016 14:07:00 GMT

Thx for the suggestion - any performance hit of input lookup vs. macro search?

Thx

Re: Possible to create search macro using Arguments for a user list?

gcusello — Thu, 13 Oct 2016 14:08:31 GMT

I don't know, but I usually use lookups.
Bye.
Giuseppe

Re: Possible to create search macro using Arguments for a user list?

jwalzerpitt — Thu, 13 Oct 2016 14:18:13 GMT

Thx for the info

Re: Possible to create search macro using Arguments for a user list?

somesoni2 — Thu, 13 Oct 2016 14:20:33 GMT

Macros are faster than lookup but with such a small number of entries in the lookup it would be negligible. Using lookups are simpler.

Re: Possible to create search macro using Arguments for a user list?

jwalzerpitt — Thu, 13 Oct 2016 14:22:50 GMT

Thx for the information!

Re: Possible to create search macro using Arguments for a user list?

ddrillic — Thu, 13 Oct 2016 14:23:55 GMT

Right - index=abc EventID=4625 username=$arg1$ looks fine or index=abc EventID=4625 username="$arg1$", with double quotes.

The search itself behaves like a regular search which means that the default operator is AND. If you want OR you should place explicit OR in the search query, such as -

index=abc EventID=4625 OR username="$arg1$"

Re: Possible to create search macro using Arguments for a user list?

jwalzerpitt — Thu, 13 Oct 2016 14:33:21 GMT

Thx for the reply and breakdown - greatly appreciated!

Re: Possible to create search macro using Arguments for a user list?

ddrillic — Thu, 13 Oct 2016 14:38:05 GMT

You are welcome - good luck.