Macro definition = ()

[stwong]

Hi all,

Just note that the macro 'cim_Authentication_indexes` of Splunk_SA_CIM has definition like following:

[cim_Authentication_indexes]
definition = ()

What does it mean?

Sorry for the newbie question.   Thanks a lot.

Regards

[stwong]

Got it.  No wonder i see nothing with pressing Shift-Ctrl-E.   

Thanks for replies from you all.

Best Regards

[isoutamo]

You should run then command first and after that this key combinations works.

[PickleRick]

This means that macro cim_Authentication_indexes expands to ()

That's the technical explanation.

But what's the purpose of such definition? Well, it's quite typical to define a macro that will be used in building condition for something else - typically you externalize the condition to a macro so that the basic search construct that you use - for example in building a visualization, or creating a report - is the same regardless of what additional limitations you want to apply to the data. This way you have the static definition in the search itself but by redefining the macro, usually as a part of configuring an app after installation, you can finetune how the search works.

In this case the macro cim_Authentication_indexes is used in definition of CIM's Authentication datamodel.

The root dataset constraint is "(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)" so by redefining the cim_Authentication_indexes macro you can easily narrow down the scope of the datamodel application only to the indexes that really contain authentication data.

[stwong]

Hi,

Thanks for your advice.

Does "()" equal to "*" in SPL ?     Seems i need to read the book "SPL for Dummies"  (if available).

Best Regards

[PickleRick · Accepted solution]

No! () does _not_ equal *.

() in this context just expands to an empty condition.  When you build a search in SPL, the parentheses group conditions and unless you specify otherwise, there is an implied AND between conditions.

So

(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)

expands to

(() tag=authenticaton NOT (action=success user=*$)

So you have an empty condition (in other words - you don't limit the events) and some further default conditions on tag, action and user.

[isoutamo]

When you have opened search which contains macro you could check how it will be expanded by Shift-Ctrl-E (in windows) and Shift-Cmd-E (in macOS).

All macros you could found Settings -> Advanced search -> Search macros

r. Ismo

Another nice key combination is Shift+Cmd/Ctrl+F