Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How to pre-process input to macro before searching in base search?

koshyk
Super Champion

We have a wonderful set of end-users who can enter dates in various formats.

Data sample is like

 

reportName="finance" team="financeTeam" reportDate="2020-08-20"
reportName="finance" team="financeTeam" reportDate="2020-08-22"
...

 

The macro wanted to return the dataset for a specific date and expectation was user to enter

 

`getmyReport(2020-08-22)`

 

but some users, enter it as `getmyReport(today)` and my challenge is to ensure such weird inputs are tackled before it hits the search engine and to do directly in the raw data

So is there a way, i can do a pre-processing of my inputs before I pass it to the raw search?

the basic trial i've done is

 

|makeresults
| eval reportDate=if(reportDate="2020*",reportDate,strftime(now(),"%F")
| search (earliest=-7d index=xyz reportDate=$reportDate$)

 

but the above doesn't work.

The SECOND option I've within the macro outside the base search

 

index=xyz
| eval reportDate=if(reportDate="2020*",reportDate,strvtime(now(),"%F")
| search (reportDate=$reportDate$)

 

This SECOND option works, But somehow I feel the second option is performance wise poor (or will Splunk automatically optimise for Splunk 6.5x onwards?)

Is there a better option to pre-process macro variables before searching within _raw dataset?

Labels (1)
Tags (3)
0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi
Maybe the easiest way is to use the input validation part of macro and require that your users enter a correctly formatted input to your macro?

Or did this help you https://community.splunk.com/t5/Dashboards-Visualizations/What-s-the-Token-name-for-the-Time-Picker-...
R. Ismo

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!