Knowledge Management

Can you help me with an issue using macros and inputlookup with a metasearch?

lakshman239
Influencer

I can run |metasearch ((index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2)) and it works — no issues.

I can create a macro, say mysrc with definition (index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2) and |metasearch mysrc works.

However, if I change the definition of the macro to pull the above search string via a lookup table |inputlookup mysrc |fields index sourcetype | format, the search "|metadata mysrc doesn't work and throws an error in metalitsearch:

 Invalid metasearch. rawdata is required for this search.

Is this a known issue with the metasearch and lookup? Thx in advance

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

0 Karma

lakshman239
Influencer

Thx Steve. At the moment, I use lookup after metasearch, but was looking to see if it can leverage the formatted search string parsed via lookup to restrict the scope of metasearch. Looks like it cannot handle lookups that way.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can always format the search string while using the lookup after the metasearch. It seems like your problem is solved, can you accept/upvote the answer to close it out?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

@lakshman239 did this answer your question? If so, can you accept it?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...