All Apps and Add-ons

Categories/groups in Splunk app for unix and linux

kunadkat
Explorer

Can I use Categories and groups defined in Splunk App for Unix in my custom search?

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Yes, you can. However, note that categories and groups are based on Splunk lookups. Due to the way that Splunk lookups work, you may need to emulate how the macros are used in the app.

For an example, see SA-nix/default/macros.conf:

[home_cpu_idle(2)]
args = unix_category, unix_group
definition = `os_index` `cpu_sourcetype` [ | inputlookup  dropdownsLookup | search $unix_category$ $unix_group$ | fields host] |mvexpand unix_group | mvexpand unix_category | search $unix_category$ $unix_group$ | eval pctUsed = 100-pctIdle | eval pctFree = pctIdle | stats median(pctFree) as metric by unix_group unix_category

What we do is use a subsearch to ensure that if a host is in more than one category, that only the group membership in the selected category is specified.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...