Splunk Search

How to update lookup using macro?

yutaka1005
Builder

When I want to update lookup using search like below, it updates lookup table even if there is no results, but I want to avoid it.
~ | outputlookup sample.csv

So, I was thinking that I can do it by using macro, and configured like below, but it didn't work.

  • Definition
    outputlookup sample.csv

  • Arguments
    arg

  • Validation Expression
    isnotnull($arg$)

  • Validation Error Message
    result is null !
    For example, in the sample search shown below, the field "result" is passed to the macro and the field is null, so I thought that I would get an error, but I did not get an error.

    | makeresults count=1
    | macro(result)
    How can I do it? If someone know about it, please tell me.

0 Karma
1 Solution

HiroshiSatoh
Champion

マクロの仕様ではなく、LOOKUPファイルを上書きしない方法の回答です。

サーチの中で元ファイルを1回追加で読み込んで、サーチ結果が0件でない場合は追加したデータを削除する動きは可能だと思います。

View solution in original post

0 Karma

HiroshiSatoh
Champion

マクロの仕様ではなく、LOOKUPファイルを上書きしない方法の回答です。

サーチの中で元ファイルを1回追加で読み込んで、サーチ結果が0件でない場合は追加したデータを削除する動きは可能だと思います。

0 Karma

yutaka1005
Builder

確かにappend=tで元ファイルを取り込んで、dedupするみたいなサーチで実現はできるんですが、macroの動作仕様が気になるので、別途質問しようかと思います…。

0 Karma

vnravikumar
Champion

Hi @yutaka1005

Check this link, similar question by @niketnilay

https://answers.splunk.com/answers/488470/macro-with-validation-isnum-does-not-work-even-if.html

0 Karma

yutaka1005
Builder

Thank you for answer.

But in that Answers, problem wasn't solved.
I do not know the reason after all, but it ended with the conclusion that isnum() function did not work well.

I wonder how some functions such as isnull (), isnum () and isnotnull () do not work well with macros.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...