Knowledge Management

Can you help me with an issue using macros and inputlookup with a metasearch?

lakshman239
SplunkTrust
SplunkTrust

I can run |metasearch ((index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2)) and it works — no issues.

I can create a macro, say mysrc with definition (index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2) and |metasearch mysrc works.

However, if I change the definition of the macro to pull the above search string via a lookup table |inputlookup mysrc |fields index sourcetype | format, the search "|metadata mysrc doesn't work and throws an error in metalitsearch:

 Invalid metasearch. rawdata is required for this search.

Is this a known issue with the metasearch and lookup? Thx in advance

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Thx Steve. At the moment, I use lookup after metasearch, but was looking to see if it can leverage the formatted search string parsed via lookup to restrict the scope of metasearch. Looks like it cannot handle lookups that way.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can always format the search string while using the lookup after the metasearch. It seems like your problem is solved, can you accept/upvote the answer to close it out?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

@lakshman239 did this answer your question? If so, can you accept it?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...