Knowledge Management

macro question - how to use the macro search results to another search?

crt89
Communicator

Good day fellow Splunkers,

I'm new to this macro in Splunk and I want to ask if this could be possible.

I have 3 monitored folders, I want to start my search to just get the latest source of this 3 folders. So I was thinking can I do a macro search to first filter my sources. 1 for each directory. So I will only have 3 sources to search for my search string.

The problem is I dont know how to configure the macro to pass the results of the macro search to a variable that I will be using for my search.

my sample macro would be:

host=host1 | stats latest(source) as host1_source_latest
(same for the other 2 directory)

then my search would be source=[the results of the macro] | [my search string]

This is what I'm planning to do, if there would be other approach it would be much appreciated.

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use macros in subsearches as you normally would in non-sub-searches. For example, if you have this search

my search string [search host=host1 | head 1 | fields source]

where the subsearch will be evaluated to source=foo, you can replace the inner contents of the subsearch with a call to a macro. It could then look something like this:

my search string [`macro`]

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can use macros in subsearches as you normally would in non-sub-searches. For example, if you have this search

my search string [search host=host1 | head 1 | fields source]

where the subsearch will be evaluated to source=foo, you can replace the inner contents of the subsearch with a call to a macro. It could then look something like this:

my search string [`macro`]

crt89
Communicator

edit: forgot to change query strings. solved now. Thanks again

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Note, I have modified the subsearch - should be a much faster way to grab the latest source.

0 Karma

crt89
Communicator

I have tried it and it works. Thank its a nice start for me to make use of macros.

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...