Splunk Search

Calling an eval-macro

ignacm01
New Member

Hi All, I can't put an eval before my search syntax so I am trying to use an eval-Macro called "FriendlyEval"
However, I can't seem to find a way to call it!

The macro

| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB

The Search

eventtype=eop_WinEventLog:Application

FriendlyEval - where I need to call the macro

host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)

| table _time host TaskCategory Type EventCode Message
| sort - _time

0 Karma

wmyersas
Builder

First, you don't need two calls to your lookup - you can do this:

| lookup Friendly_Name.csv Friendly OUTPUT FullHost FullHostHSB

Secondly, what prevents you from doing this:

eventtype=eop_WinEventLog:Application `FriendlyEval`
| <rest of your search>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When using a macro, the expanded macro definition has to make sense (like you had written the query using the definition instead of the macro). In your example,

eventtype=eop_WinEventLog:Application
| eval Friendly=$Friend$
| lookup Friendly_Name.csv Friendly OUTPUT FullHost
| lookup Friendly_Name.csv Friendly OUTPUT FullHostHSB
host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
Type IN ($Type01$)

| table _time host TaskCategory Type EventCode Message
| sort - _time

Doesn't work because 'host IN...' is out of place. Try this:

eventtype=eop_WinEventLog:Application

`FriendlyEval`

| where (host IN (FullHost, FullHostHSB) Message="OMIS $omis01$" OR TaskCategory="omis $omis01$"
AND Type IN ($Type01$))
| table _time host TaskCategory Type EventCode Message
| sort - _time
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...