When I want to update lookup using search like below, it updates lookup table even if there is no results, but I want to avoid it.
~ | outputlookup sample.csv
So, I was thinking that I can do it by using macro, and configured like below, but it didn't work.
Definition
outputlookup sample.csv
Arguments
arg
Validation Expression
isnotnull($arg$)
Validation Error Message
result is null !
For example, in the sample search shown below, the field "result" is passed to the macro and the field is null, so I thought that I would get an error, but I did not get an error.
| makeresults count=1
| macro(result)
How can I do it? If someone know about it, please tell me.
マクロの仕様ではなく、LOOKUPファイルを上書きしない方法の回答です。
サーチの中で元ファイルを1回追加で読み込んで、サーチ結果が0件でない場合は追加したデータを削除する動きは可能だと思います。
マクロの仕様ではなく、LOOKUPファイルを上書きしない方法の回答です。
サーチの中で元ファイルを1回追加で読み込んで、サーチ結果が0件でない場合は追加したデータを削除する動きは可能だと思います。
確かにappend=tで元ファイルを取り込んで、dedupするみたいなサーチで実現はできるんですが、macroの動作仕様が気になるので、別途質問しようかと思います…。
Hi @yutaka1005
Check this link, similar question by @niketnilay
https://answers.splunk.com/answers/488470/macro-with-validation-isnum-does-not-work-even-if.html
Thank you for answer.
But in that Answers, problem wasn't solved.
I do not know the reason after all, but it ended with the conclusion that isnum()
function did not work well.
I wonder how some functions such as isnull ()
, isnum ()
and isnotnull ()
do not work well with macros.