Splunk Search

## How to create a eval-based macro

Explorer

I am trying to approximate the distance between two points. Each point has a latitude, longitude, and elevation. Unfortunately Splunk can't do sines and cosines out of the box, so I had to use a Taylor polynomial in my function:

``````| eval lat0=\$lat0\$*pi()/180
| eval lat1=\$lat1\$*pi()/180
| eval lon0=\$lon0\$*pi()/180
| eval lon1=\$lon1\$*pi()/180
| eval coslat0=1-pow(lat0,2)/(2*1)+pow(lat0,4)/(4*3*2*1)-pow(lat0,6)/(6*5*4*3*2*1)
| eval coslon0=1-pow(lon0,2)/(2*1)+pow(lon0,4)/(4*3*2*1)-pow(lon0,6)/(6*5*4*3*2*1)
| eval sinlat0=lat0-pow(lat0,3)/(3*2*1)+pow(lat0,5)/(5*4*3*2*1)-pow(lat0,7)/(7*6*5*4*3*2*1)
| eval sinlon0=lon0-pow(lon0,3)/(3*2*1)+pow(lon0,5)/(5*4*3*2*1)-pow(lon0,7)/(7*6*5*4*3*2*1)
| eval coslat1=1-pow(lat1,2)/(2*1)+pow(lat1,4)/(4*3*2*1)-pow(lat1,6)/(6*5*4*3*2*1)
| eval coslon1=1-pow(lon1,2)/(2*1)+pow(lon1,4)/(4*3*2*1)-pow(lon1,6)/(6*5*4*3*2*1)
| eval sinlat1=lat1-pow(lat1,3)/(3*2*1)+pow(lat1,5)/(5*4*3*2*1)-pow(lat1,7)/(7*6*5*4*3*2*1)
| eval sinlon1=lon1-pow(lon1,3)/(3*2*1)+pow(lon1,5)/(5*4*3*2*1)-pow(lon1,7)/(7*6*5*4*3*2*1)
| eval x0=\$ele0\$*coslat0*sinlon0
| eval x1=\$ele1\$*coslat1*sinlon1
| eval y0=\$ele0\$*sinlat0
| eval y1=\$ele1\$*sinlat1
| eval z0=\$ele0\$*coslat0*coslon0+6370
| eval z1=\$ele1\$*coslat1*coslon1+6370
| eval distance=sqrt(pow(x1-x0,2)+pow(y1-y0,2)+pow(z1-z0,2))
``````

I would call this macro `distance(6)` with the 6 variables: `lat0`, `lon0`, `ele0`, `lat1`, `lon1`, `ele1`.

How do I create/use this macro so I can use it in a search like this:

``````index="gpx" source="/home/hobbes3/strava/a_nice_ride.gpx" | ... | eval distance=`distance(lat0, lon0, ele0, lat1, lon1, ele1)`
``````
Tags (2)
1 Solution
Splunk Employee

Strictly speaking, that's not an eval-based macro. You should simply be able to take the body of your eval statements and paste them into the macro definition. The name of the macro would be distance(6) indicating six args, and you'll want to line up your \$lat0\$, etc arguments with the args specifier of the macro.

Finally, you'll call it as | `distance(...)`, with the output field name of "distance" being implicit.

Splunk Employee

Strictly speaking, that's not an eval-based macro. You should simply be able to take the body of your eval statements and paste them into the macro definition. The name of the macro would be distance(6) indicating six args, and you'll want to line up your \$lat0\$, etc arguments with the args specifier of the macro.

Finally, you'll call it as | `distance(...)`, with the output field name of "distance" being implicit.

Get Updates on the Splunk Community!

#### Splunk Love - Splunk in One Word: Explore Our .conf24 Splunk Word Cloud

We deeply believe that the best way to understand the impact of Splunk is by hearing your voice directly. So, ...

#### Digital Resilience Made Easier With GenAI

TECH TALKS Digital Resilience Made Easier With GenAI Thursday, September 5, 2024  |  11AM PST / 2PM ...

#### Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Watch ...