topic Save SPL commands into one SPL new command in Splunk Search

Save SPL commands into one SPL new command

shayhibah — Tue, 03 Sep 2019 08:32:55 GMT

Hi,

Is it possible to save SPL command into one new command and use it when running a query?

For example:
| dedup 1 id | stats count by hostname ----> my_command

When running a query, I want to use it as:
| my_command

How can I do that?

Thanks

broberg — Tue, 03 Sep 2019 08:45:44 GMT

If you saved this as MySavedSearch

| dedup 1 id | stats count by hostname

Then you can do this:

| savedsearch MySavedSearch

Also, if you schedule MySavedSearch, you could also use loadjob to load the results of the previous run (instead of re-running it ad-hoc).

thomasroulet — Tue, 03 Sep 2019 09:55:45 GMT

you can use Search macros.