Knowledge Management

How to run a macro multiple times in a search?

mjm_bhatiarahul
New Member

Hello,

I am trying to run a macro multiple times in a search. If the search returns 10 results, the macro should run 10 times. Is there a way to achieve this?

I don't want to use 'map' command for this. The macro contains simple lookup statements that I want to execute in my search. Depending on how many search results are returned, the macro will run those many times and execute the lookup statements.

Thanks

0 Karma
1 Solution

David_Naylor
Path Finder

Hello

Give this a go

| foreach result [macro_name_here]

I successfully tested this methodology in my test environment by running the following (after changing the macro's permission)

index=_internal |head 10 | foreach result [dmc_get_core_info]

As expected this gave me a core_info field in each event

Goodluck! -David

View solution in original post

0 Karma

David_Naylor
Path Finder

Hello

Give this a go

| foreach result [macro_name_here]

I successfully tested this methodology in my test environment by running the following (after changing the macro's permission)

index=_internal |head 10 | foreach result [dmc_get_core_info]

As expected this gave me a core_info field in each event

Goodluck! -David

0 Karma

mjm_bhatiarahul
New Member

Thanks David... I was not aware that 'foreach' could be used like this to run for each search result.

The only thing I am missing now is the ability to pass field values to the macro. I have gone through a few threads and it seems it is not possible to pass the values as arguments to a macro.

But thanks for pointing this out with 'foreach'!

0 Karma

somesoni2
Revered Legend

What lookup command is run in the macro?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...