Dashboards & Visualizations
Highlighted

compute the macro name to be used in a search

Path Finder

Hi Guys,
Is it possible to calculate the name of a macro to be used in a search from a token value?

I have a drop down list of system names that I have corresponding macros for.

eg
key = ABC - macro = ABChosts
key = DEF - macro = DEF
hosts
key = GHI - macro = GHI_hosts

When a user selects an item from the list I want to use the token in my search to compute which macro to use. Is there a way to compute the macro name in the search?

$system$host
if the user selected ABC I would like the search to have the following calculated using the token
index="
main" ABC_hosts

Thanks 🙂

0 Karma
Highlighted

Re: compute the macro name to be used in a search

SplunkTrust
SplunkTrust

Well, in theory tokens are replaced in a dashboard before the search runs, so this should work as long as ABC_hosts uses the proper format of a macro

`ABC_hosts`

so, just try it and see if it works for you 😉

cheers, MuS

Highlighted

Re: compute the macro name to be used in a search

Path Finder

Thanks Mas for the response, I guess my problem is how to I turn the value to my token into a macro.

I'm not sure of the syntax, how do I add the value of the token and _hosts and have splunk treat it as a macro?

so it my token value is ABC I want to add host to it an pop some quotes around it so it becomes 'ABChosts'

Thanks in advance

0 Karma
Highlighted

Re: compute the macro name to be used in a search

Legend

@Melstrathdee there would be multiple ways to do this

1) Code <change> event handler for dropdown to set for macro to be replaced in search query
2) Code <change> event handler for dropdown to set complete search query with macro replaced selected value.
3) Modify SPL to have macro call and actual macro value to be replaced with value selected in dropdown. (As pointed out my @MuS)

You should be able to find examples of each on Splunk answers.

If you can give sample SPL to be invoked for couple of dropdown values selected we would be able to assist you with specific option you want to implement.




| eval message="Happy Splunking!!!"


Highlighted

Re: compute the macro name to be used in a search

Path Finder

Thanks guys I got it working using the following code:
it basically puts the macros with thei name and code in a table and returns one column as the name and the the search string column as the field value.
Thanks for the help

sysName
definition


$sysName$

| rest splunkserver=local /servicesNS/-/-/admin/macros | search eai:acl.app="myapp" title="*hosts"
| eval sysName = substr(title, 1, len(title)-6)
| Table sysName, title, definition

View solution in original post

0 Karma