All Apps and Add-ons

Constant strings

dreadangel
Path Finder

Hi,

I'm using dbdata (https://splunkbase.splunk.com/app/4253/) application in order to access my REST endpoint to collect events to splunk.
Here is a sample:

| dbdata url="[Endpoint url]?param1=value1&param2=value2" headers="[headers data]"

So as far I have several searches, is it possible in splunk to consfigure parametrized constants for url and headers params, so I could reuse them in those searches - kind of searches global config:

| dbdata url=URL_CONSTANT."?param1=value1&param2=value2" headers=HEADER_CONSTANT

Any thoughts?

0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, first create macros called URL_CONSTANT and HEADER_CONSTANT that have your strings, then use it like this:

| makereuslts
| eval url = `URL_CONSTANT` . "?param1=value1&param2=value2", headers=`HEADER_CONSTANT`
| map search="| dbdata url=$url$ headers=headers"

View solution in original post

woodcock
Esteemed Legend

Yes, first create macros called URL_CONSTANT and HEADER_CONSTANT that have your strings, then use it like this:

| makereuslts
| eval url = `URL_CONSTANT` . "?param1=value1&param2=value2", headers=`HEADER_CONSTANT`
| map search="| dbdata url=$url$ headers=headers"

dreadangel
Path Finder

thanks, macros is the solution here -

Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...