topic Calling an eval-macro in Splunk Search

Calling an eval-macro

ignacm01 — Wed, 30 Sep 2020 04:18:38 GMT

Hi All, I can't put an eval before my search syntax so I am trying to use an eval-Macro called "FriendlyEval"
However, I can't seem to find a way to call it!

The macro

| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB

The Search

eventtype=eop_WinEventLog:Application

FriendlyEval - where I need to call the macro

host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)

| table _time host TaskCategory Type EventCode Message
| sort - _time

Re: Calling an eval-macro

richgalloway — Fri, 21 Feb 2020 18:46:39 GMT

When using a macro, the expanded macro definition has to make sense (like you had written the query using the definition instead of the macro). In your example,

eventtype=eop_WinEventLog:Application
| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB
host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)

| table _time host TaskCategory Type EventCode Message
| sort - _time

Doesn't work because 'host IN...' is out of place. Try this:

eventtype=eop_WinEventLog:Application

`FriendlyEval`

| where (host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
AND Type IN ($Type01$))
| table _time host TaskCategory Type EventCode Message
| sort - _time

Re: Calling an eval-macro

wmyersas — Fri, 21 Feb 2020 18:48:55 GMT

First, you don't need two calls to your lookup - you can do this:

| lookup Friendly_Name.csv Friendly OUTPUT FullHost FullHostHSB

Secondly, what prevents you from doing this:

eventtype=eop_WinEventLog:Application `FriendlyEval`
| <rest of your search>