Splunk Search

Getting macro parameters from search result?

Splunk Employee
Splunk Employee

I have a macro that accepts 5 arguments. I was hoping to get the arguments into the macro from a previous search result, as in something along these lines:

... | head 5 | mvcombine delim="," parameters | `search_macro(parameters)`

Unfortunately, this approach fails, since "parameters" in the macro call is interpreted as the literal string rather than the 5 value, comma separated, result field.

Is there any way of accomplishing this kind of behavior?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

No there is not, not exactly. This is kind of where the difference between a macro (which is just string substitutions) and a function becomes apparent. Ideally, you'd have been able to wrap the eval into a function definition, but Splunk doesn't provide those. You could make "pretend" functions using macros, e.g.

[my_macro(1)]
args = a1
definition = eval p1=mvindex($a1$,0) | eval p2=mvindex($a1$,1) | eval p3=mvindex($a1$,2) | eval x=len(p1)+len(p2) | eval y=x*sqrt(p3)

And you'd have to call it with:

... | head 3 | mvcombine delim="," parameters  | `my_macro(parameters)`

But at this point I wonder if any simplification benefits from a macro are lost.

The closest thing to a function definition would be a custom search command, but that's probably got a lot more overhead than you really need.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

No there is not, not exactly. This is kind of where the difference between a macro (which is just string substitutions) and a function becomes apparent. Ideally, you'd have been able to wrap the eval into a function definition, but Splunk doesn't provide those. You could make "pretend" functions using macros, e.g.

[my_macro(1)]
args = a1
definition = eval p1=mvindex($a1$,0) | eval p2=mvindex($a1$,1) | eval p3=mvindex($a1$,2) | eval x=len(p1)+len(p2) | eval y=x*sqrt(p3)

And you'd have to call it with:

... | head 3 | mvcombine delim="," parameters  | `my_macro(parameters)`

But at this point I wonder if any simplification benefits from a macro are lost.

The closest thing to a function definition would be a custom search command, but that's probably got a lot more overhead than you really need.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!