Knowledge Management

How to run a macro multiple times in a search?

mjm_bhatiarahul
New Member

Hello,

I am trying to run a macro multiple times in a search. If the search returns 10 results, the macro should run 10 times. Is there a way to achieve this?

I don't want to use 'map' command for this. The macro contains simple lookup statements that I want to execute in my search. Depending on how many search results are returned, the macro will run those many times and execute the lookup statements.

Thanks

0 Karma
1 Solution

David_Naylor
Path Finder

Hello

Give this a go

| foreach result [macro_name_here]

I successfully tested this methodology in my test environment by running the following (after changing the macro's permission)

index=_internal |head 10 | foreach result [dmc_get_core_info]

As expected this gave me a core_info field in each event

Goodluck! -David

View solution in original post

0 Karma

David_Naylor
Path Finder

Hello

Give this a go

| foreach result [macro_name_here]

I successfully tested this methodology in my test environment by running the following (after changing the macro's permission)

index=_internal |head 10 | foreach result [dmc_get_core_info]

As expected this gave me a core_info field in each event

Goodluck! -David

View solution in original post

0 Karma

mjm_bhatiarahul
New Member

Thanks David... I was not aware that 'foreach' could be used like this to run for each search result.

The only thing I am missing now is the ability to pass field values to the macro. I have gone through a few threads and it seems it is not possible to pass the values as arguments to a macro.

But thanks for pointing this out with 'foreach'!

0 Karma

somesoni2
Revered Legend

What lookup command is run in the macro?

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on