Splunk Search

How to create flexible search strings?

thinhdinh
Path Finder

Hello Experts,

I am wondering is there any ways to make the search strings flexibly? Like I have multiple queries as below:

- index=index_1 host=host_1 (scope=A OR scope=B) | .... 

- index=index_2 host=host_2 (scope=C OR scope=D) | .... 

- index=index_3 host=host_3 (scope=A OR scope=B OR scope=E OR scope=F) | ....

So instead of writting a macro with 3 arguments: $index$, $host$, $scopes$

- customMacro(3)

We just pass only index as argument and based on the number in the index, we modify the host and scope?

- host=case(match(index,1), host_1...)

Thank in advance!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @thinhdinh ,

macros is one solution.

I usually use eventtypes and tags in my apps because in this way I have only one point to modify when I have to change something.

In addition you can created indentated eventtypes:

eventtype_index: index=index1

eventtype_login_win; EventCode=4624

and use a combination of them.

Ciao.

Giuseppe

thinhdinh
Path Finder

Thank you @gcusello . This solution is new to me and sounds great! Anyway I am still looking for another way like where we create another macro to return value. So basically we have 2 more macro like below:

  • getHost(index)
  • getScope(index)

Do you know any commands in Splunk supports us to to like this?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @thinhdinh ,

No as I said, macros is the best solution for your need.

I usually use eventtypes and tags especially when I have to use different searches in one, e.g. if I have an eventtype for each kind of login (login of windows, login of linux, login of firewall, login of proxy, etc...) each with the same tag (e.g. LOGIN or LOGOUT or LOGFAIL), with only one command (e.g. tag=LOGIN) I take all these searches.

Ciao and happy splunking.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...