topic Re: Macro returns no result when applied in Splunk Search

Macro returns no result when applied

klausJohan — Fri, 11 Oct 2013 12:32:03 GMT

Hello,

Could someone explain what am I doing wrong in using a macro ?

Here is the macros.conf file

[GET_IP]
definition = 127.0.0.1

The search query I intend to use is :

source="mySource" AND object.ip_address='GET_IP'

However, if I paste the above query in the search bar I obtain no result . On the other hand if I do the same thing for the expanded query (source="mySource" AND object.ip_address=127.0.0.1) I get all the events back .

Re: Macro returns no result when applied

alacercogitatus — Mon, 28 Sep 2020 14:57:04 GMT

You need to use backticks, not quotes, and probably make it eval macro.

macros.conf
[GET_IP] definition = "\"127.0.0.1\"" iseval = true

source="mySource" object.ip_address=GET_IP

Re: Macro returns no result when applied

klausJohan — Mon, 28 Sep 2020 14:57:07 GMT

The "backtip " opened my eyes about how to properly use a macro in a search. Now I obtain an error : Error in 'SearchParser': Could not find macro 'GET_IP' that takes 0 arguments. Expecting stanza name 'GET_IP'.

Re: Macro returns no result when applied

alacercogitatus — Fri, 11 Oct 2013 13:01:36 GMT

try this url: http://your_splunk:8000/en-US/debug/refresh/?entity=admin/macros and then try your search again.

Re: Macro returns no result when applied

klausJohan — Fri, 11 Oct 2013 13:09:29 GMT

Thanks. I'm still getting an error back . This time is "Error in 'SearchParser': The definition of macro 'GET_IP' is expected to be an eval expression that returns a string"

Re: Macro returns no result when applied

alacercogitatus — Fri, 11 Oct 2013 13:13:41 GMT

try your initial definition.

Re: Macro returns no result when applied

klausJohan — Fri, 11 Oct 2013 14:22:44 GMT

Thanks .Worked with : definition = "127.0.0.1"