How to create flexible search strings?

[thinhdinh]

Hello Experts,

I am wondering is there any ways to make the search strings flexibly? Like I have multiple queries as below:

- index=index_1 host=host_1 (scope=A OR scope=B) | .... 

- index=index_2 host=host_2 (scope=C OR scope=D) | .... 

- index=index_3 host=host_3 (scope=A OR scope=B OR scope=E OR scope=F) | ....

So instead of writting a macro with 3 arguments: $index$, $host$, $scopes$

- customMacro(3)

We just pass only index as argument and based on the number in the index, we modify the host and scope?

- host=case(match(index,1), host_1...)

Thank in advance!

[gcusello]

Hi @thinhdinh ,

macros is one solution.

I usually use eventtypes and tags in my apps because in this way I have only one point to modify when I have to change something.

In addition you can created indentated eventtypes:

eventtype_index: index=index1

eventtype_login_win; EventCode=4624

and use a combination of them.

Ciao.

Giuseppe

[thinhdinh]

Thank you @gcusello . This solution is new to me and sounds great! Anyway I am still looking for another way like where we create another macro to return value. So basically we have 2 more macro like below:

• getHost(index)
• getScope(index)

Do you know any commands in Splunk supports us to to like this?

[gcusello]

Hi @thinhdinh ,

No as I said, macros is the best solution for your need.

I usually use eventtypes and tags especially when I have to use different searches in one, e.g. if I have an eventtype for each kind of login (login of windows, login of linux, login of firewall, login of proxy, etc...) each with the same tag (e.g. LOGIN or LOGOUT or LOGFAIL), with only one command (e.g. tag=LOGIN) I take all these searches.

Ciao and happy splunking.

Giuseppe