Splunk Search

How can I escape dollar-signs to use "map" or "sendemail" inside of a macro or workflow?

woodcock
Esteemed Legend

All 4 things use the $argument$ syntax. I am trying to use sendemail inside of a macro and have tried \$search\$, $$search$$, and $$$search$$$ but none works. Is it even possible?

My macro is this:

sendemail
sendresults=true
inline=true
graceful=true
to=whatever@gmail.com
subject="subject"
message="This report alert was generated by search $name$ in $app$ Splunk with this search string: $search$"

And the $name$, $app$, and $search$ are being eaten.

See dox here:
https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

woodcock
Esteemed Legend

Let me restate my problem. There are multiple things in Splunk that use the $argument$ syntax. The question is: how do I get 2 of those things to work together when they both think that $argument$ is for him. In this case, the 2 things are macro and sendemail. How do I get macro not to mess up the arguments that are intended for sendemail.

0 Karma

efavreau
Builder

@woodcock It's difficult for me to test. It's sparked a lot of conversation over here. I see someone else can't test it. Do you think you could work this into a run anywhere example of where you are so far? Then people could test in parallel. At a minimum, we could comment on what we tried and what didn't work. At the most, we'd find the solution. Thoughts?

###

If this reply helps you, an upvote would be appreciated.
0 Karma

efavreau
Builder

@woodcock I'm not clear on what you mean. I have a simple search:

index=_internal sourcetype=splunkd_access user=efavreau |  stats count

Created a macro:
name: testsendemail(3)
definition: sendemail sendresults=true inline=true graceful=true to=me@me.com subject="subject" message="This report alert was generated by search $name$ in $app$ Splunk with this search string: $search$ "
args: name, app, search

Put it all together:

index=_internal sourcetype=splunkd_access user=efavreau 
|  stats count
| `testsendemail(mytest,FOOAPP,"index=_internal sourcetype=splunkd_access user=efavreau |  stats count")`

Ran it in the GUI and that worked for me in v6.6.6. So then I scheduled the report on a cron * * * * * , and that worked too.
Am I missing something?

###

If this reply helps you, an upvote would be appreciated.
0 Karma

woodcock
Esteemed Legend

Let me clarify. I get the email, but the 3 variables do not get dereferenced; they get dropped altogether. so the message should be This report alert was generated by search This Is The Search Name in AppName Splunk with this search string: index=foo sourcetype=bar ... but instead I get This report alert was generated by search in Splunk with this search string:.

0 Karma

woodcock
Esteemed Legend

Wait a minute. I think I have the answer. As long as the variables for the "other" thing do not match the names of the arguments of my macro, my macro should ignore them (I think)! Testing now...

0 Karma

woodcock
Esteemed Legend

Did not work.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Isn't the "!" the correct escape character here? Got nothing to test right now..
I think it's $!variable$

0 Karma

woodcock
Esteemed Legend

This is also a problem for ldapsearch command as documented (and solved!) here: https://answers.splunk.com/answers/223246/workflow-action-contains-other-variables-how-do-i.html
Unfortunately, the solution was to use a macro!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.