Splunk Search

How to re-use list of values.

iet_ashish
Explorer

I have a query which essentially looks like this,

| makeresults count=1 
| eval host="host1, host2, host3, host4, host5, host6" 
| makemv tokenizer="([^,]+),?" host 
| mvexpand host 
| fields - _time 
| join type=left host 
    [ search index=someIndex host IN (host1, host2, host3, host4, host5, host6) 
    | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

As one can see I have to pass the list of hosts "host1, host2, host3, host4, host5, host6", once during "makeresults" and another time in the sub search. Is there any way to declare a variable for this list.

Is there a way to avoid this duplication. Sometimes this list of hosts can be really long. I want to send this query to a non-IT user who doesn't understand Splunk too well and was wondering if I can reduce the hassle for him.

Thanks,
Ashish

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You can update search query to use token parameter and save this search as Report (saved search).

| makeresults count=1 
 | eval host="$hosts$" 
 | makemv tokenizer="([^,]+),?" host 
 | mvexpand host 
 | fields - _time 
 | join type=left host 
     [ search index=someIndex host IN ($hosts$) 
     | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

Once you save make sure to check permissions. Ask users to run saved search using savedsearch command with parameter like below:

| savedsearch saved_search_name hosts="host1, host2, host3, host4, host5, host6" 

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

You can update search query to use token parameter and save this search as Report (saved search).

| makeresults count=1 
 | eval host="$hosts$" 
 | makemv tokenizer="([^,]+),?" host 
 | mvexpand host 
 | fields - _time 
 | join type=left host 
     [ search index=someIndex host IN ($hosts$) 
     | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

Once you save make sure to check permissions. Ask users to run saved search using savedsearch command with parameter like below:

| savedsearch saved_search_name hosts="host1, host2, host3, host4, host5, host6" 

iet_ashish
Explorer

This is exactly what I was looking for. Thanks.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The concept you're looking for is called macros. In the UI, go to Settings -> Advanced Search -> Search Macros to create one, remember to set sharing to App, and refer to the macro in your search using backticks. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you store the hosts inside the macro you only need to list them out once, over all searches that require this particular list.

0 Karma

iet_ashish
Explorer

Unfortunately this does not work for us. Let say I define a parameterized macro - "hostlist".
Even in this case the user would have to pass the macro to query twice,

makeresults 1
| hosts=hostlist(host1, host2, host3,....)
|join type=left
| [search host IN (
hostlist(host1, host2, host3,....)`)]

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...