topic How to pass indexes from a macro to another search in Splunk Search

How to pass indexes from a macro to another search

thinhdinh — Fri, 10 Jul 2020 08:05:54 GMT

Hello experts,

I am using makeresults command to create a macro like below:

| `get_indexes_by_args(1)`

And the macro will return the string like below:

index IN ("apps", "_apps")

Now I want to pass this macro to another macro. How can I solve it? It will be like this:

| `get_indexes_by_args("app")` "/api/" | ....

Re: How to pass indexes from a macro to another search

isoutamo — Fri, 10 Jul 2020 12:58:31 GMT

macro can contain another macro, so write it just like first one.

`macro1(1)` which then contains `get_indexes_by_args(1)`

r. Ismo

Re: How to pass indexes from a macro to another search

thinhdinh — Mon, 13 Jul 2020 12:33:49 GMT

@isoutamo Thank you for replying, but I still don't get it. So in the second macro I write like this:

`get_indexes_by_args($index$)`....|

And then in the search bar I write the query like below

| `the_second_macro(...)`

And it is not working. Could you show me where I was wrong?

Re: How to pass indexes from a macro to another search

isoutamo — Mon, 13 Jul 2020 15:40:14 GMT

1st macro

macro1(1)

sourcetype=$st$

parameter named as st

2nd macro

macro2(1)

`macro1($st$)`

parameter as st

call it as

index=_internal `macro2(splunkd)`

Re: How to pass indexes from a macro to another search

isoutamo — Mon, 13 Jul 2020 20:07:14 GMT

If this solve your issue, please accept it as solution so other people also known it.

Re: How to pass indexes from a macro to another search

thinhdinh — Thu, 16 Jul 2020 11:34:16 GMT

To be honestly I still don't get it works, but I just accepted it as solution. Hope someone can get your idea. Cause I mentioned above, inside the first macro I use makeresults command to returned flexible indexes and I think maybe I did something wrong here. By the way I knew how to use a macro inside another macro, cause I have another one on my local splunk and it works well. Anyway thanks for your helps.

Re: How to pass indexes from a macro to another search

isoutamo — Thu, 16 Jul 2020 19:11:59 GMT

Ok, can you show your macros.conf, so we can look if we found solution to you?