Can I use Categories and groups defined in Splunk App for Unix in my custom search?
Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.
For an example, see SA-nix/default/macros.conf:
[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category
What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.
Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.
For an example, see SA-nix/default/macros.conf:
[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category
What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.