topic Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow? in Splunk Search

How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock — Wed, 20 Mar 2019 01:16:08 GMT

All 4 things use the $argument$ syntax. I am trying to use sendemail inside of a macro and have tried \$search\$, $$search$$, and $$$search$$$ but none works. Is it even possible?

My macro is this:

sendemail
sendresults=true
inline=true
graceful=true
to=whatever@gmail.com
subject="subject"
message="This report alert was generated by search $name$ in $app$ Splunk with this search string: $search$"

And the $name$ , $app$ , and $search$ are being eaten.

See dox here:
https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock — Wed, 20 Mar 2019 01:51:21 GMT

This is also a problem for ldapsearch command as documented (and solved!) here: https://answers.splunk.com/answers/223246/workflow-action-contains-other-variables-how-do-i.html
Unfortunately, the solution was to use a macro!

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock — Wed, 20 Mar 2019 01:53:12 GMT

Wait a minute. I think I have the answer. As long as the variables for the "other" thing do not match the names of the arguments of my macro, my macro should ignore them (I think)! Testing now...

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock — Wed, 20 Mar 2019 02:03:13 GMT

Did not work.

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

efavreau — Wed, 20 Mar 2019 12:13:48 GMT

@woodcock I'm not clear on what you mean. I have a simple search:

index=_internal sourcetype=splunkd_access user=efavreau |  stats count

Created a macro:
name: testsendemail(3)
definition: sendemail sendresults=true inline=true graceful=true to=me@me.com subject="subject" message="This report alert was generated by search $name$ in $app$ Splunk with this search string: $search$ "
args: name, app, search

Put it all together:

index=_internal sourcetype=splunkd_access user=efavreau 
|  stats count
| `testsendemail(mytest,FOOAPP,"index=_internal sourcetype=splunkd_access user=efavreau |  stats count")`

Ran it in the GUI and that worked for me in v6.6.6. So then I scheduled the report on a cron * * * * * , and that worked too.
Am I missing something?

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock — Wed, 20 Mar 2019 14:13:25 GMT

Let me clarify. I get the email, but the 3 variables do not get dereferenced; they get dropped altogether. so the message should be This report alert was generated by search This Is The Search Name in AppName Splunk with this search string: index=foo sourcetype=bar ... but instead I get This report alert was generated by search in Splunk with this search string:.

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

skalliger — Wed, 20 Mar 2019 14:32:03 GMT

Isn't the "!" the correct escape character here? Got nothing to test right now..
I think it's $!variable$

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock — Wed, 20 Mar 2019 15:50:04 GMT

Let me restate my problem. There are multiple things in Splunk that use the $argument$ syntax. The question is: how do I get 2 of those things to work together when they both think that $argument$ is for him. In this case, the 2 things are macro and sendemail. How do I get macro not to mess up the arguments that are intended for sendemail.

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

efavreau — Thu, 21 Mar 2019 18:54:01 GMT

@woodcock It's difficult for me to test. It's sparked a lot of conversation over here. I see someone else can't test it. Do you think you could work this into a run anywhere example of where you are so far? Then people could test in parallel. At a minimum, we could comment on what we tried and what didn't work. At the most, we'd find the solution. Thoughts?

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

ejwade — Tue, 03 Sep 2024 23:34:36 GMT

I'm having the same issue, @woodcock. Let me know if you figured it out (you usually do). 🙂

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

SanjayReddy — Fri, 06 Sep 2024 06:59:39 GMT

Hi @ejwade

I’m a Community Moderator in the Splunk Community.

you are replying to question was posted couple of years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question with errors so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!

Re: How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

PickleRick — Fri, 06 Sep 2024 07:29:13 GMT

And back to the original question - I suspect it's just how it works. Macro expansion is after all just a simple string substitution, there is no complicated magic behind it. If it's something that could be useful, you might consider posting an idea on https://ideas.splunk.com