Splunk Search
Highlighted

Calling an eval-macro

New Member

Hi All, I can't put an eval before my search syntax so I am trying to use an eval-Macro called "FriendlyEval"
However, I can't seem to find a way to call it!

The macro

| eval Friendly=$Friend$
| lookup FriendlyName.csv Friendly OUTPUT FullHost
| lookup Friendly
Name.csv Friendly OUTPUT FullHostHSB

The Search

eventtype=eop_WinEventLog:Application

FriendlyEval - where I need to call the macro

host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)

| table _time host TaskCategory Type EventCode Message
| sort - _time

0 Karma
Highlighted

Re: Calling an eval-macro

SplunkTrust
SplunkTrust

When using a macro, the expanded macro definition has to make sense (like you had written the query using the definition instead of the macro). In your example,

eventtype=eop_WinEventLog:Application
| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB
host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)

| table _time host TaskCategory Type EventCode Message
| sort - _time

Doesn't work because 'host IN...' is out of place. Try this:

eventtype=eop_WinEventLog:Application

`FriendlyEval`

| where (host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
AND Type IN ($Type01$))
| table _time host TaskCategory Type EventCode Message
| sort - _time
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Calling an eval-macro

Builder

First, you don't need two calls to your lookup - you can do this:

| lookup Friendly_Name.csv Friendly OUTPUT FullHost FullHostHSB

Secondly, what prevents you from doing this:

eventtype=eop_WinEventLog:Application `FriendlyEval`
| <rest of your search>
0 Karma