Using field values as paramaters for macros

[stephanbuys]

I am trying to create a macro that would take as it's input the result of an eval earlier in the search string, for example:

eval mytime=now() | extract_duplicate(mytime)

Is there a way to do this? mytime might even be substituted as part of a scheduled saved search (for example mytime=starttimeu) to collect summary index data.

Running the search with a literal works fine: extract_duplicate(1271816301)

[Lowell · Accepted solution]

Hmm. This is not an answer to your question, exactly, but I suspect that since your talking about passing time values into macros and you're looking to use this for summary indexing, then I suspect that you may be trying to post-filter your search with something like a | where _time<my_field

If I'm wrong about this, then you can just ignore the rest.

---

I use the following macro as a post-search command that will drop off a given number of hours from the end of a search time range.

[si_txn_trim_h(1)]
args = hours
definition = addinfo | where _time < (info_max_time-($hours$*3600)) | fields - info_*
iseval = 0

I use the addinfo search command to get the info_max_time (or you can use the info_min_time, if you want the earliest value instead of the latest value).

Also note that I wrote this for Splunk 4.0. Now, I would recommend instead using the relative_time eval function instead of assuming "hours", which would be much more flexible. But for the purpose of comparison, I suspect I would replace this with the following in 4.1:

definition = addinfo | where _time < relative_time(info_max_time,"-$hours$h") | fields - info_*

[stephanbuys]

This is a great tip, I have also verified that you can use addinfo in subsearches of a scheduled search, so this will solve my problem. Thanks!

[gkanapathy]

No it is not possible. Macros are distinct from functions, and are simple string substitutions and do not pass values. For this you would need functions. It is possible to "almost" do it, but it would require you to rewrite the macro, e.g.,

[extract_duplicate(1)]
args = a1
definition = eval mytime = $a1$ | blah xxx=mytime

called with:

`extract_duplicate(now())`

Separately, you can't get starttimeu either from within a search query. Also, starttimeeu is deprecated in favor of earliest.

[stephanbuys]

Thank you! We were looking for function capabilities, but Lowell's solution will help us to get the search working.