All Apps and Add-ons

Categories/groups in Splunk app for unix and linux

Explorer

Can I use Categories and groups defined in Splunk App for Unix in my custom search?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.

View solution in original post

0 Karma