Knowledge Management

Can you help me with an issue using macros and inputlookup with a metasearch?

SplunkTrust
SplunkTrust

I can run |metasearch ((index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2)) and it works — no issues.

I can create a macro, say mysrc with definition (index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2) and |metasearch mysrc works.

However, if I change the definition of the macro to pull the above search string via a lookup table |inputlookup mysrc |fields index sourcetype | format, the search "|metadata mysrc doesn't work and throws an error in metalitsearch:

 Invalid metasearch. rawdata is required for this search.

Is this a known issue with the metasearch and lookup? Thx in advance

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Thx Steve. At the moment, I use lookup after metasearch, but was looking to see if it can leverage the formatted search string parsed via lookup to restrict the scope of metasearch. Looks like it cannot handle lookups that way.

0 Karma

SplunkTrust
SplunkTrust

You can always format the search string while using the lookup after the metasearch. It seems like your problem is solved, can you accept/upvote the answer to close it out?

0 Karma

SplunkTrust
SplunkTrust

@lakshman239 did this answer your question? If so, can you accept it?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!