Splunk Search

How to use macros to search data and persist data?

jamin358
Explorer

I'm creating a bunch of status dashboards where I need to search for a specific set of hosts and persist a result (adding null value later)

I want to use the same macros to keep my search sizes down.

I want to have searches that look like this 

 

 

index=main host IN (`listofhosts`) 
| do some filtering 
| append [| makeresults | eval host = "`listofhosts`" | eval state=0 | makemv delim="," host | mvexpand host | fields host state] 
| stats first(*) AS * by host 
| do some more cool stuff

 

 

 I know that my hosts don't have spaces in them, so I figure I can write `listofhosts` as

 

 

host1,host2,host3,host4

 

 

without quotes so the host search at the top will work. But "`listofhosts`" does call the macro (because its in a string).

So, is there any way to call a macro within the body of a string?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You don't need to invoke the macro from within a string.  Just build a quoted string around the macro.

| eval host = "\"" . `listofhosts` . "\""
---
If this reply helps you, Karma would be appreciated.
0 Karma

jamin358
Explorer

Unfortunately this work

| makeresults | eval host="\"" . `hostlist` . "\"" | makemv delim="," host | mvexpand host | fields host

macro: `hostlist` = host1,host2,host3,host4

Error: "Field 'host' does not exist in the data"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...