Dashboards & Visualizations

compute the macro name to be used in a search

Melstrathdee
Path Finder

Hi Guys,
Is it possible to calculate the name of a macro to be used in a search from a token value?

I have a drop down list of system names that I have corresponding macros for.

eg
key = ABC - macro = ABC_hosts
key = DEF - macro = DEF_hosts
key = GHI - macro = GHI_hosts

When a user selects an item from the list I want to use the token in my search to compute which macro to use. Is there a way to compute the macro name in the search?

$system$_host
if the user selected ABC I would like the search to have the following calculated using the token
index="_main" ABC_hosts

Thanks 🙂

0 Karma
1 Solution

Melstrathdee
Path Finder

Thanks guys I got it working using the following code:
it basically puts the macros with thei name and code in a table and returns one column as the name and the the search string column as the field value.
Thanks for the help

sysName
definition


$sysName$

| rest splunk_server=local /servicesNS/-/-/admin/macros | search eai:acl.app="my_app" title="*hosts"
| eval sysName = substr(title, 1, len(title)-6)
| Table sysName, title, definition

View solution in original post

0 Karma

Melstrathdee
Path Finder

Thanks guys I got it working using the following code:
it basically puts the macros with thei name and code in a table and returns one column as the name and the the search string column as the field value.
Thanks for the help

sysName
definition


$sysName$

| rest splunk_server=local /servicesNS/-/-/admin/macros | search eai:acl.app="my_app" title="*hosts"
| eval sysName = substr(title, 1, len(title)-6)
| Table sysName, title, definition

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Well, in theory tokens are replaced in a dashboard before the search runs, so this should work as long as ABC_hosts uses the proper format of a macro

`ABC_hosts`

so, just try it and see if it works for you 😉

cheers, MuS

Melstrathdee
Path Finder

Thanks Mas for the response, I guess my problem is how to I turn the value to my token into a macro.

I'm not sure of the syntax, how do I add the value of the token and _hosts and have splunk treat it as a macro?

so it my token value is ABC I want to add _host to it an pop some quotes around it so it becomes 'ABC_hosts'

Thanks in advance

0 Karma

niketnilay
Legend

@Melstrathdee there would be multiple ways to do this

1) Code <change> event handler for dropdown to set for macro to be replaced in search query
2) Code <change> event handler for dropdown to set complete search query with macro replaced selected value.
3) Modify SPL to have macro call and actual macro value to be replaced with value selected in dropdown. (As pointed out my @MuS)

You should be able to find examples of each on Splunk answers.

If you can give sample SPL to be invoked for couple of dropdown values selected we would be able to assist you with specific option you want to implement.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!