All Apps and Add-ons

Categories/groups in Splunk app for unix and linux

kunadkat
Explorer

Can I use Categories and groups defined in Splunk App for Unix in my custom search?

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...