topic Re: inputlookup in macro in Knowledge Management

inputlookup in macro

JensT — Mon, 05 Aug 2013 18:37:57 GMT

Hi,

I have this search:

| inputlookup mySearch | where foo=bar

Now I'd like to do this:

mySearch(bar)

with definition = | inputlookup mySearch | where foo=$bar$

But it does not work.

I get: Error in 'inputlookup' command: This command must be the first command of a search.

How can i use inputlookup in a macro?

Regards, Jens

Re: inputlookup in macro

linu1988 — Mon, 05 Aug 2013 19:03:04 GMT

It happens because Splunk adds an search before MACRO, Savedsearch when it's called. So if you just mention the |inputlookup macro(bar) then it will work. Thanks. There may be some other solution but i can tell this much.

Re: inputlookup in macro

martin_mueller — Tue, 06 Aug 2013 06:56:43 GMT

Here's what is happening: Splunk is turning this query

`mySearch(bar)`

into this:

search `mySearch(bar)`

which is then expanded into this:

search | inputlookup yada yada yada

To get around this you need to move the pipe out of the macro and into the search:

| `mySearch(bar)`

This will make sure Splunk does not add the implicit search command.