Getting macro parameters from search result?

[jwestberg]

I have a macro that accepts 5 arguments. I was hoping to get the arguments into the macro from a previous search result, as in something along these lines:

... | head 5 | mvcombine delim="," parameters | `search_macro(parameters)`

Unfortunately, this approach fails, since "parameters" in the macro call is interpreted as the literal string rather than the 5 value, comma separated, result field.

Is there any way of accomplishing this kind of behavior?

[gkanapathy · Accepted solution]

No there is not, not exactly. This is kind of where the difference between a macro (which is just string substitutions) and a function becomes apparent. Ideally, you'd have been able to wrap the eval into a function definition, but Splunk doesn't provide those. You could make "pretend" functions using macros, e.g.

[my_macro(1)]
args = a1
definition = eval p1=mvindex($a1$,0) | eval p2=mvindex($a1$,1) | eval p3=mvindex($a1$,2) | eval x=len(p1)+len(p2) | eval y=x*sqrt(p3)

And you'd have to call it with:

... | head 3 | mvcombine delim="," parameters  | `my_macro(parameters)`

But at this point I wonder if any simplification benefits from a macro are lost.

The closest thing to a function definition would be a custom search command, but that's probably got a lot more overhead than you really need.