Splunk Enterprise

macro with arguments

sarit_s
Communicator

Hello,

I have a csv file which contains 12 columns and i want to use the values of the columns as arguments in my search. 
i thought the best way to achieve it will be with macro that will read the file but im not sure how to do it. 
maybe there is another way ?

i also tried this query :

 

 

[| inputlookup concurrency_rules.csv | fields Used* | transpose | rename "row 1" as eventtype | fields eventtype]
| transaction maxpause=2s maxspan=1s maxevents=5
| eval max_time=(duration + _time)
| eval min_time=(_time)
| rename kafka_uuid as uuids
| where eventcount!=5
| table  eventtype ,min_time, max_time,tail_id,uuids

 

 


it is working but not dynamic as i wanted. the file supposed to have more than 1 row so the rename of row 1 is not good enough and also not all the values  in row 1 are eventtypes. also i have more fields there that i want to use as arguments

thanks for the help

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...