topic Re: How to create flexible search strings? in Splunk Search

How to create flexible search strings?

thinhdinh — Wed, 01 Jul 2020 17:22:14 GMT

Hello Experts,

I am wondering is there any ways to make the search strings flexibly? Like I have multiple queries as below:

- index=index_1 host=host_1 (scope=A OR scope=B) | ....

- index=index_2 host=host_2 (scope=C OR scope=D) | ....

- index=index_3 host=host_3 (scope=A OR scope=B OR scope=E OR scope=F) | ....

So instead of writting a macro with 3 arguments: $index$, $host$, $scopes$

- customMacro(3)

We just pass only index as argument and based on the number in the index, we modify the host and scope?

- host=case(match(index,1), host_1...)

Thank in advance!

Re: How to create flexible search strings?

gcusello — Wed, 01 Jul 2020 13:04:16 GMT

Hi @thinhdinh ,

macros is one solution.

I usually use eventtypes and tags in my apps because in this way I have only one point to modify when I have to change something.

In addition you can created indentated eventtypes:

eventtype_index: index=index1

eventtype_login_win; EventCode=4624

and use a combination of them.

Ciao.

Giuseppe

Re: How to create flexible search strings?

thinhdinh — Wed, 01 Jul 2020 17:28:41 GMT

Thank you @gcusello . This solution is new to me and sounds great! Anyway I am still looking for another way like where we create another macro to return value. So basically we have 2 more macro like below:

getHost(index)
getScope(index)

Do you know any commands in Splunk supports us to to like this?

Re: How to create flexible search strings?

gcusello — Thu, 02 Jul 2020 07:01:00 GMT

Hi @thinhdinh ,

No as I said, macros is the best solution for your need.

I usually use eventtypes and tags especially when I have to use different searches in one, e.g. if I have an eventtype for each kind of login (login of windows, login of linux, login of firewall, login of proxy, etc...) each with the same tag (e.g. LOGIN or LOGOUT or LOGFAIL), with only one command (e.g. tag=LOGIN) I take all these searches.

Ciao and happy splunking.

Giuseppe