topic Re: How do I make macro arguments get parsed as fields instead of literals? in Knowledge Management

How do I make macro arguments get parsed as fields instead of literals?

MonkeyK — Fri, 29 Jun 2018 21:05:21 GMT

I am trying to create a macro that will take a field from an existing query. But when I try to call it the macro treats its argument as a literal value rather than the search field value.

Specifically what I am trying to do is to lookup info about a queried machine in Carbon Black.

the macro looks like this

name: reqsensorsearch(1)
sensorsearch query="$sensor_search$"

I tried testing my macro with

|makeresults | eval sensor_search="hostname:<myhost>" | `reqsensorsearch(sensor_search)`

but if I do Ctrl+Shift+E (to expand and display), I see this

| makeresults 
| eval sensor_search="hostname:<myhost>" 
| sensorsearch query="sensor_search"

What do I need to do to make the macro accept the value of the field sensor_search? So I can get it to run as

 |sensorsearch query="hostname:<myhost>"

Re: How do I make macro arguments get parsed as fields instead of literals?

woodcock — Sat, 30 Jun 2018 02:52:50 GMT

Change your macro definition to this:

 eval sensorsearch query="\"" . $sensor_search$ . "\""

Re: How do I make macro arguments get parsed as fields instead of literals?

MonkeyK — Tue, 29 Sep 2020 20:15:29 GMT

do you mean like this?
| makeresults
| eval sensor_search="hostname:"
| eval sensorsearch query="\"" . $sensor_search$ . "\""

in that case, it expands to
| makeresults
| eval sensor_search="hostname:"
| eval sensorsearch query="\"" . $sensor_search$ . "\""

and the results come out as
_time sensor_search sensorsearch query
2018-07-02 08:45:03 hostname: "hostname:"

so that just eval's "seansorsearch query" as a value

I also tried removing the second eval, for which sensorsearch command still failed. I should note that if I run sensorsearch directly, it works fine, but if it is run as

| makeresults 
| eval sensor_search="hostname:<myhost>"
| sensorsearch query="\"" . $sensor_search$ . "\""

I get back and error message and searchlog shows:
07-02-2018 08:47:42.608 INFO SearchParser - PARSING: | makeresults | eval sensor_search="hostname:" | sensorsearch query="\"" . $sensor_search$ . "\""

Re: How do I make macro arguments get parsed as fields instead of literals?

woodcock — Mon, 02 Jul 2018 14:09:28 GMT

No, no, no. Keep your SPL for testing the way that it is and change the definition of the macro itself to be exactly what is in my solution.

Re: How do I make macro arguments get parsed as fields instead of literals?

MonkeyK — Tue, 29 Sep 2020 20:15:37 GMT

Oh. Of course, sorry. But then I still get the same results as when it is inline. That is it just writes the string rather than running the command:

_time sensor_search sensorsearch query
2018-07-02 10:01:43 hostname:wxlpf0v968r "hostname:wxlpf0v968r"

Re: How do I make macro arguments get parsed as fields instead of literals?

woodcock — Tue, 03 Jul 2018 02:33:06 GMT

OK, look, define the macro the way that I showed you and then run this search:

|makeresults | eval sensor_search="hostname:<myhost>" | `reqsensorsearch(sensor_search)`

Re: How do I make macro arguments get parsed as fields instead of literals?

MonkeyK — Tue, 29 Sep 2020 20:16:08 GMT

I really think that is what I am doing

My macro:
Definition: eval sensorsearch query="\"" . $sensor_search$ . "\""
user eval-based definition: not checked
Arguments: sensor_search

search line:
|makeresults | eval sensor_search="hostname:" | reqsensorsearch(sensor_search)

results:
_time sensor_search sensorsearch query
2018-07-03 08:38:14 hostname: "hostname:"

Re: How do I make macro arguments get parsed as fields instead of literals?

woodcock — Tue, 03 Jul 2018 23:23:04 GMT

OK, let's back all the way up.
I have your original macro defined as reqsensorsearch_bad with:

eval sensorsearch query="$sensor_search$"

The result of this:

|makeresults | eval sensor_search="hostname:<myhost>" | `reqsensorsearch_bad(sensor_search)`

is this:

_time   sensor_search   sensorsearch query
2018-07-03 18:20:01 hostname:<myhost>   sensor_search

The result of this:

|makeresults | eval sensor_search="hostname:<myhost>" | `reqsensorsearch(sensor_search)`

Is this:

_time   sensor_search   sensorsearch query
2018-07-03 18:19:03 hostname:<myhost>   "hostname:<myhost>"

The bottom line is that macro arguments behave the way that you treat them. If you treat them as string literals, then they will behave that way; if you treat them as field names, then they will behave that way.