Splunk Cloud Platform

How to create Macros based on field list?

SplunkExplorer
Contributor

Hi Splunkers, I'm trying to send one Splunk Cloud instance alerts to a Cortex XSOAR one.
The guide I'm following is the following one: Splunk py for NON ES users. Due we have not Enterprise Security, I must follow steps described in section Splunk non-Enterprise Security Users. 

Following this guide, what makes me a bit confused is step 4; they states only to create a macro to capture fields saved on a local file, but no indication on how to achieve this. I mean: I know I can put in macro code I want to reuse in more alerts, for example reuse the same where conditions in multiple different rules, but how should be the syntax to achieve what the guide states?

For example, if following step 2 and 3 I got the following field list:

list(field)
Blade,
ReachedPorts,
count,
dst_ip,
earliest_timestamp,
latest_timestamp,
src_ip,
src_user,
total_dst_port,

what code should I put on macro to "capture" them? Should I simply put fields list in macro code?

 

Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Those instructions are somewhat strange - the save to a local file seems a bit redundant and I'm not sure I understand the purpose of creating a macro with the table statement and the field list - unless you're going to re-use that macro in other places.

It seems like all they have done is Settings->Advanced Search->Macros and created a new macro with 

table list_of_field_names

so, it seems like all it is telling you is to make a table command with the wanted fields in the macro. 

Don't prefix it with the | symbol, so you can do

| `my_macro`

but I guess it's up to you if you feel you need a macro in the first place.

SplunkExplorer
Contributor

I share your own doubts.

Thanks for answer, I will try; may be I found an alternative way, so your help is enough for now.

0 Karma

SplunkExplorer
Contributor

Hi Slunkers, anyone able to help me on this issue?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...