I would like to execute macrowithargs repeatedly using by source. How can I pass the arg_value to the macro?
Context: syslog-like events from over thousands sites for a given time range are saved in each site-source-file. As a whole, …zip file is added to Splunk. For one site-source-file, I made search series and got a desired result (a), then defined the macrowithargs by extracting a core search series from (a) as (b). The defined macro was tested alone and got the same result as (a) did.
index=… sourcetype=… source=specific-file-name-within…zip-file | series of search | stats perc50(X) dc(Y) values(Z)
macro name: perSITEinfowithargs(1)
search source=$in_source$ | series of search | stats perc50(X) dc(Y) values(Z)
As a new search, I expected the following search (c) work, but got no results:
index=… sourcetype=… | `perSITEinfo_with_args(source)` by source
Q1: How can I pass the arg_value to the macro?
Q2: Does this approach (macro call repeatedly) work?
If not, what is another approach? Sub search?
It is appreciated if a “transformation” way from macro approach to another approach were explained.
If the "series of search" is the same for all different sources, then you don't need a macro, although you could build one for the "source=" list below. Try this -
index=… sourcetype=… (source=filename1withinzip OR source=filename1withinzip OR source=filename1withinzip ...) | series of search | stats perc50(X) dc(Y) values(Z) by source
index=… sourcetype=… | perSITEinfo_with_args(specific-file-name-source-within…zip-file) by source
search index=… sourcetype=… $in_source$ | series of search | stats perc50(X) dc(Y) values(Z) by source
after run with
source=specific-file-name-source args like this :