Categories/groups in Splunk app for unix and linux

[kunadkat]

Can I use Categories and groups defined in Splunk App for Unix in my custom search?

[araitz · Accepted solution]

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.