topic using a search macro inside mvmap, missing ) in Splunk Search

using a search macro inside mvmap, missing )

Cyrus — Wed, 20 Oct 2021 23:25:32 GMT

Hi Community - I'm trying to extend the Levenshtein distance query in this tutorial: https://www.splunk.com/en_us/blog/tips-and-tricks/you-can-t-hyde-from-dr-levenshtein-when-you-use-url-toolbox.html.

Specifically, I'm trying to evaluate the Levenshtein distance of an email domain against multiple comparison domains on one line, with the resulting values going into a multivalue field. I tried doing this with mvmap:

| eval lev=mvmap(inspect_domains, `ut_levenshtein(ut_domain, inspect_domains)`)

Where inspect_domains is the multivalue field containing comparative domains, and ut_levenshtein is a search macro in the URL Toolbox app .

This returns an error: "Error in 'eval' command: The expression is malformed. Expected ). "
To my eye, the parentheses appear to be balanced. I nevertheless tried adding or removing parentheses to try to make Splunk happy, but no combination of parentheses seems to work

Any ideas?

Re: using a search macro inside mvmap, missing )

ryanoconnor — Fri, 22 Oct 2021 02:31:33 GMT

I don't think mvmap is going to work in that context based on the contents of that specific macro.

Can you give this SPL a shot? It's not one line, but it's close and should still get you where you need to go. Unless there is a specific reason it needs to be a one-liner.

Re: using a search macro inside mvmap, missing )

Cyrus — Sun, 24 Oct 2021 19:36:25 GMT

Thank you for taking the time to respond. That didn't quite work, but it gave me the idea for a rough solution: by using mvappend to join together all of the email domains I want to inspect against, followed immediately by an mvexpand to generate separate line items per event per domain, I can run the ut_levenshtein macro against everything.

| eval inspect_domains=mvappend("yahoo.com", "google.com", "outlook.com")
| mvexpand inspect_domains
| `ut_levenshtein(sender_domain, inspect_domains)`

Not very elegant and may not scale, but it works well enough for now. Thanks again.