Hi All, I can't put an eval before my search syntax so I am trying to use an eval-Macro called "FriendlyEval"
However, I can't seem to find a way to call it!
The macro
| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB
The Search
eventtype=eop_WinEventLog:Application
FriendlyEval
- where I need to call the macro
host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)
| table _time host TaskCategory Type EventCode Message
| sort - _time
First, you don't need two calls to your lookup - you can do this:
| lookup Friendly_Name.csv Friendly OUTPUT FullHost FullHostHSB
Secondly, what prevents you from doing this:
eventtype=eop_WinEventLog:Application `FriendlyEval`
| <rest of your search>
When using a macro, the expanded macro definition has to make sense (like you had written the query using the definition instead of the macro). In your example,
eventtype=eop_WinEventLog:Application
| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB
host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)
| table _time host TaskCategory Type EventCode Message
| sort - _time
Doesn't work because 'host IN...' is out of place. Try this:
eventtype=eop_WinEventLog:Application
`FriendlyEval`
| where (host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
AND Type IN ($Type01$))
| table _time host TaskCategory Type EventCode Message
| sort - _time