How to create a new field using macros?

[andra_pietraru]

I am trying to add a new field in my events using eval, but I am getting errors.
My search looks like this:

... | eval newField=`getIpBasedOnMac($mac$)` | chart values(field1) over newField by mac

Any suggestions on how I could create newField and give it the value that the macro returns?

[jeffland]

Your eval will create the field for this event, in this search.

With the above macro definition, try
... |getIpBasedOnMac(mac) | chart values(field1) over ip by mac

[andra_pietraru]

I tried. No results.

[jeffland]

With splunk, "no results" is not the same as "doesn't work". Maybe there was no ip for that mac? Have you tried your macro code as an individual search, with the mac entered manually?
Generally, when you put an eval expression in a macro, you can use the field you eval'd after the macro.

[andra_pietraru]

When I try the macro code as a search, I get back the event that has that mac and ip fields in it. So the macro is ok.

I also tried calling the macro in two different ways:
1. sourcetype=xmlConfig|findIpBasedOnMac(0000000001)|table *
AND
2. sourcetype=other|findIpBasedOnMac(0000000001)|table *

The first search gives the event that I want. The second one returns no results.

[jeffland]

Ah. Sorry. Does your base search contain events of the sourcetype that the macro needs? Whether inside a macro or not, the eval that is supposed to deliver the new field needs to see the required data from the base search, as it does not run a subsearch to gather its own data. Maybe all you need to do is adjust your base search to include the xmlConfig sourcetype, such as index=foo sourcetype=other OR sourcetype=xmlConfig | ...

[andra_pietraru]

Do you know how I could pass a field from an outer search to a subsearch? Is that possible?

For example:
sourcetype=1|eval newField=[search sourcetype=2 innerField=outerField|return something|format] ...

[jeffland]

No, subsearches are run before the main search.

[andra_pietraru]

My base search did not contain the sourcetype needed in the macro. After I add it, I get back one event, the one from the macro. But I don't get anything for the chart.
I will keep trying. Thanks!