How to create a eval-based macro

[hobbes3]

I am trying to approximate the distance between two points. Each point has a latitude, longitude, and elevation. Unfortunately Splunk can't do sines and cosines out of the box, so I had to use a Taylor polynomial in my function:

| eval lat0=$lat0$*pi()/180
| eval lat1=$lat1$*pi()/180
| eval lon0=$lon0$*pi()/180
| eval lon1=$lon1$*pi()/180
| eval coslat0=1-pow(lat0,2)/(2*1)+pow(lat0,4)/(4*3*2*1)-pow(lat0,6)/(6*5*4*3*2*1)
| eval coslon0=1-pow(lon0,2)/(2*1)+pow(lon0,4)/(4*3*2*1)-pow(lon0,6)/(6*5*4*3*2*1)
| eval sinlat0=lat0-pow(lat0,3)/(3*2*1)+pow(lat0,5)/(5*4*3*2*1)-pow(lat0,7)/(7*6*5*4*3*2*1)
| eval sinlon0=lon0-pow(lon0,3)/(3*2*1)+pow(lon0,5)/(5*4*3*2*1)-pow(lon0,7)/(7*6*5*4*3*2*1)
| eval coslat1=1-pow(lat1,2)/(2*1)+pow(lat1,4)/(4*3*2*1)-pow(lat1,6)/(6*5*4*3*2*1)
| eval coslon1=1-pow(lon1,2)/(2*1)+pow(lon1,4)/(4*3*2*1)-pow(lon1,6)/(6*5*4*3*2*1)
| eval sinlat1=lat1-pow(lat1,3)/(3*2*1)+pow(lat1,5)/(5*4*3*2*1)-pow(lat1,7)/(7*6*5*4*3*2*1)
| eval sinlon1=lon1-pow(lon1,3)/(3*2*1)+pow(lon1,5)/(5*4*3*2*1)-pow(lon1,7)/(7*6*5*4*3*2*1)
| eval x0=$ele0$*coslat0*sinlon0
| eval x1=$ele1$*coslat1*sinlon1
| eval y0=$ele0$*sinlat0
| eval y1=$ele1$*sinlat1
| eval z0=$ele0$*coslat0*coslon0+6370
| eval z1=$ele1$*coslat1*coslon1+6370
| eval distance=sqrt(pow(x1-x0,2)+pow(y1-y0,2)+pow(z1-z0,2))

I would call this macro distance(6) with the 6 variables: lat0, lon0, ele0, lat1, lon1, ele1.

How do I create/use this macro so I can use it in a search like this:

index="gpx" source="/home/hobbes3/strava/a_nice_ride.gpx" | ... | eval distance=`distance(lat0, lon0, ele0, lat1, lon1, ele1)`

[sowings · Accepted solution]

Strictly speaking, that's not an eval-based macro. You should simply be able to take the body of your eval statements and paste them into the macro definition. The name of the macro would be distance(6) indicating six args, and you'll want to line up your $lat0$, etc arguments with the args specifier of the macro.

Finally, you'll call it as | `distance(...)`, with the output field name of "distance" being implicit.