Splunk Search

How to re-use list of values.

iet_ashish
Explorer

I have a query which essentially looks like this,

| makeresults count=1 
| eval host="host1, host2, host3, host4, host5, host6" 
| makemv tokenizer="([^,]+),?" host 
| mvexpand host 
| fields - _time 
| join type=left host 
    [ search index=someIndex host IN (host1, host2, host3, host4, host5, host6) 
    | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

As one can see I have to pass the list of hosts "host1, host2, host3, host4, host5, host6", once during "makeresults" and another time in the sub search. Is there any way to declare a variable for this list.

Is there a way to avoid this duplication. Sometimes this list of hosts can be really long. I want to send this query to a non-IT user who doesn't understand Splunk too well and was wondering if I can reduce the hassle for him.

Thanks,
Ashish

0 Karma
1 Solution

manjunathmeti
Champion

You can update search query to use token parameter and save this search as Report (saved search).

| makeresults count=1 
 | eval host="$hosts$" 
 | makemv tokenizer="([^,]+),?" host 
 | mvexpand host 
 | fields - _time 
 | join type=left host 
     [ search index=someIndex host IN ($hosts$) 
     | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

Once you save make sure to check permissions. Ask users to run saved search using savedsearch command with parameter like below:

| savedsearch saved_search_name hosts="host1, host2, host3, host4, host5, host6" 

View solution in original post

manjunathmeti
Champion

You can update search query to use token parameter and save this search as Report (saved search).

| makeresults count=1 
 | eval host="$hosts$" 
 | makemv tokenizer="([^,]+),?" host 
 | mvexpand host 
 | fields - _time 
 | join type=left host 
     [ search index=someIndex host IN ($hosts$) 
     | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

Once you save make sure to check permissions. Ask users to run saved search using savedsearch command with parameter like below:

| savedsearch saved_search_name hosts="host1, host2, host3, host4, host5, host6" 

View solution in original post

iet_ashish
Explorer

This is exactly what I was looking for. Thanks.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The concept you're looking for is called macros. In the UI, go to Settings -> Advanced Search -> Search Macros to create one, remember to set sharing to App, and refer to the macro in your search using backticks. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you store the hosts inside the macro you only need to list them out once, over all searches that require this particular list.

0 Karma

iet_ashish
Explorer

Unfortunately this does not work for us. Let say I define a parameterized macro - "hostlist".
Even in this case the user would have to pass the macro to query twice,

makeresults 1
| hosts=hostlist(host1, host2, host3,....)
|join type=left
| [search host IN (
hostlist(host1, host2, host3,....)`)]

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.