topic Re: How to pass list string as an arguments to Splunk macro in Splunk Search

How to pass list string as an arguments to Splunk macro

thinhdinh — Tue, 23 Jun 2020 06:11:49 GMT

Hi Splunk experts,

I am a new face here. I have a task for multiple alerts creating. I am wondering is it possible to pass a list of strings as an argument to my custom macro. Let's me explain more about the idea:

My argument will be like this:

"scope=A"

"scope=A OR scope=B"

"scope=A OR scope=B OR scope=C"

....

Basically scope can be equals to whatever value as much as we need and I want to write a macro just has only one argument, but I still could add number of values to my macro:

myMacro(1)

How can I solve it? Thank in advance.

Re: How to pass list string as an arguments to Splunk macro

bowesmana — Tue, 23 Jun 2020 22:45:40 GMT

You can create the macro with one argument and pass what you like, so all of your examples would be fine.

However what is it you are trying to achieve with that macro. I am guessing it's some kind of search filtering from your examples.

It looks like you're wanting to have a flexible 'search for x=y' where x and y can be 1..n and x can be different fields also or is 'x' always scope?

Can you explain in more detail what you want the macro to do and where in the search pipeline it's intended for, part of the base search or following the first | (pipe)

Re: How to pass list string as an arguments to Splunk macro

thinhdinh — Wed, 24 Jun 2020 06:09:41 GMT

Hi @bowesmana ,

Exactly! That is what you are guessing. The reason I want to like that because I have bunch of scopes and I don't want for each of scope I have to write a macro. I need to make the argument that I am passing to my macro is flexible., from that we only have one macro. Value of scopes will be added before the pipeline and they are searching strings. Example:

host=host source=source ("scope=A OR scope=B OR scope=C OR...") | .....

Re: How to pass list string as an arguments to Splunk macro

bowesmana — Wed, 24 Jun 2020 06:13:12 GMT

Maybe you would be better of just writing

host=host source=source scope IN ("A","B","C") | .....

I am assuming the scope is a field in your data?

Re: How to pass list string as an arguments to Splunk macro

thinhdinh — Wed, 24 Jun 2020 11:37:52 GMT

Hi @bowesmana

It looks super simple 🙂. Yes, that is a field of my data.

Re: How to pass list string as an arguments to Splunk macro

thinhdinh — Thu, 25 Jun 2020 07:47:55 GMT

@bowesmana Hi, sorry to bother you again. So how can I pass those scopes to my macro?! When I tried to do something like this, it's not working for me:

myCustomMacro(scope=("A", "B", "C"))

Re: How to pass list string as an arguments to Splunk macro

bowesmana — Thu, 25 Jun 2020 21:59:43 GMT

I am not sure what you want the macro to do - what is the need to have a macro in the first place.

What will the macro in addition to the search itself?

Re: How to pass list string as an arguments to Splunk macro

thinhdinh — Thu, 25 Jun 2020 22:58:26 GMT

I have bunch of different scope as I said before and for each of those scope I have to write an alert. With a help from macro, my task should more easier. That's why I need a macro with a flexible argument. Yes, I have moved the argument to the search itself, it's not required in the first place.

Re: How to pass list string as an arguments to Splunk macro

bowesmana — Thu, 25 Jun 2020 23:31:27 GMT

The search will produce a set of results and the alert will come from those results. I don't see where the macro is required in this, but perhaps you can provide some more detail on the actual result you are looking to get out of this alert.

Re: How to pass list string as an arguments to Splunk macro

thinhdinh — Fri, 26 Jun 2020 07:03:17 GMT

Sure we can write different search queries for each scope, but it is too long. That's why I want to use macro in this case. I don't have one alert, I have bunch of alerts and the result of them depends on their scopes. As I know macro is not required to use if we don't like.