https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453034#M6351 <P>Glad it helped. Pls vote to accept the comment/answers and also post your answers for future readers.</P> Thu, 28 Mar 2019 12:03:25 GMT lakshman239 2019-03-28T12:03:25Z https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453031#M6348 <P>Hi,</P> <P>I am trying to figure out how to pass a field value in the search to a macro which interprets it and does further processing through a lookup table.</P> <P>I have consulted multiple threads but due to karma cannot link to them. Currently my approach is as follows:</P> <P>Search</P> <PRE><CODE>index=my_index my_custom_field="the_value_to_filter_for" | map search="|`my_processing_macro($my_custom_field_)`" </CODE></PRE> <P>Macro: my_processing_macro(1) (argument defined as name)</P> <PRE><CODE>lookup my_lookup_table_def $name$ as lookup_table_column1 </CODE></PRE> <P>Lookup table (CSV-format): linked to lookup table definition</P> <PRE><CODE>lookup_table_column1,lookup_table_column2 value_i_pass_in_macro, value_i_want_returned </CODE></PRE> <P>So in short, the value I pass in my_custom_field corresponds to a column1 row in the lookup table. Basically column 2 contains the regex or other macro's to expand during processing.</P> Tue, 29 Sep 2020 23:47:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453031#M6348 hexerino 2020-09-29T23:47:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453032#M6349 <P>The below search should work .. are you seeing any errors? You need $$ and test your macros by using both <CODE>|</CODE>yourmacro(1)` pipe and without pipe and adjust</P> <PRE><CODE>index=my_index my_custom_field="the_value_to_filter_for" | map search=" search `my_processing_macro($my_custom_field$)`" </CODE></PRE> Tue, 26 Mar 2019 11:13:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453032#M6349 lakshman239 2019-03-26T11:13:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453033#M6350 <P>After long deliberation we decided to adopt a different filtering strategy. This method worked after some alteration. Thank you for your suggestion !</P> Thu, 28 Mar 2019 10:26:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453033#M6350 hexerino 2019-03-28T10:26:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453034#M6351 <P>Glad it helped. Pls vote to accept the comment/answers and also post your answers for future readers.</P> Thu, 28 Mar 2019 12:03:25 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/pass-field-value-in-search-as-an-argument-to-be-used-in-a-macro/m-p/453034#M6351 lakshman239 2019-03-28T12:03:25Z