Splunk Search

How to create flexible search strings?

Path Finder

Hello Experts,

I am wondering is there any ways to make the search strings flexibly? Like I have multiple queries as below:

- index=index_1 host=host_1 (scope=A OR scope=B) | .... 

- index=index_2 host=host_2 (scope=C OR scope=D) | .... 

- index=index_3 host=host_3 (scope=A OR scope=B OR scope=E OR scope=F) | ....

So instead of writting a macro with 3 arguments: $index$, $host$, $scopes$

- customMacro(3)

We just pass only index as argument and based on the number in the index, we modify the host and scope?

- host=case(match(index,1), host_1...)

Thank in advance!

Labels (2)
0 Karma

Esteemed Legend

Hi @thinhdinh ,

macros is one solution.

I usually use eventtypes and tags in my apps because in this way I have only one point to modify when I have to change something.

In addition you can created indentated eventtypes:

eventtype_index: index=index1

eventtype_login_win; EventCode=4624

and use a combination of them.



Path Finder

Thank you @gcusello . This solution is new to me and sounds great! Anyway I am still looking for another way like where we create another macro to return value. So basically we have 2 more macro like below:

  • getHost(index)
  • getScope(index)

Do you know any commands in Splunk supports us to to like this?

0 Karma

Esteemed Legend

Hi @thinhdinh ,

No as I said, macros is the best solution for your need.

I usually use eventtypes and tags especially when I have to use different searches in one, e.g. if I have an eventtype for each kind of login (login of windows, login of linux, login of firewall, login of proxy, etc...) each with the same tag (e.g. LOGIN or LOGOUT or LOGFAIL), with only one command (e.g. tag=LOGIN) I take all these searches.

Ciao and happy splunking.


Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...