All Apps and Add-ons

Can i use a macro without an arguments?

royimad
Builder

I have a search that i need to introduce in a macro, the macro is with no arguments.
How to do that ?

Search:
| set union [search sourcetype="log4j"
| stats count by SEVERITY_WEBAPP, origine
| where SEVERITY_WEBAPP="ERROR" OR SEVERITY_WEBAPP="FATAL" OR SEVERITY_WEBAPP="WARN" | rename SEVERITY_WEBAPP as SEVERITY]
[search source="/home/splunk/app4_error_core.log" | stats count by SEVERITY_CORE , origine
| where SEVERITY_CORE="ERROR" OR SEVERITY_CORE="FATAL" OR SEVERITY_CORE="WARN" | rename SEVERITY_CORE as SEVERITY ]
| JOIN left outer origine,SEVERITY
[ set union [search sourcetype="log4j"
| top limit=1 COMPONENTS_WEB by SEVERITY_WEBAPP, origine
| where SEVERITY_WEBAPP="ERROR" OR SEVERITY_WEBAPP="FATAL" OR SEVERITY_WEBAPP="WARN" | rename SEVERITY_WEBAPP as SEVERITY | rename COMPONENTS_WEB as "TOP COMPONENTS"]
[search source="/home/splunk/app4_error_core.log" | top limit=1 COMPONENTS_CORE by SEVERITY_CORE , origine
| where SEVERITY_CORE="ERROR" OR SEVERITY_CORE="FATAL" OR SEVERITY_CORE="WARN" | rename SEVERITY_CORE as SEVERITY | rename COMPONENTS_CORE as "TOP COMPONENTS"] ]

0 Karma

yannK
Splunk Employee
Splunk Employee

yes you can define a macro that is not expecting an argument.

example : rename_macro

rename COMPONENTS_WEB as "TOP COMPONENTS"

to call it, use back quotes.
see http://docs.splunk.com/Documentation/Splunk/5.0.2/Search/Usesearchmacros

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...