Splunk Search

How to use macros to search data and persist data?

jamin358
Explorer

I'm creating a bunch of status dashboards where I need to search for a specific set of hosts and persist a result (adding null value later)

I want to use the same macros to keep my search sizes down.

I want to have searches that look like this 

 

 

index=main host IN (`listofhosts`) 
| do some filtering 
| append [| makeresults | eval host = "`listofhosts`" | eval state=0 | makemv delim="," host | mvexpand host | fields host state] 
| stats first(*) AS * by host 
| do some more cool stuff

 

 

 I know that my hosts don't have spaces in them, so I figure I can write `listofhosts` as

 

 

host1,host2,host3,host4

 

 

without quotes so the host search at the top will work. But "`listofhosts`" does call the macro (because its in a string).

So, is there any way to call a macro within the body of a string?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You don't need to invoke the macro from within a string.  Just build a quoted string around the macro.

| eval host = "\"" . `listofhosts` . "\""
---
If this reply helps you, Karma would be appreciated.
0 Karma

jamin358
Explorer

Unfortunately this work

| makeresults | eval host="\"" . `hostlist` . "\"" | makemv delim="," host | mvexpand host | fields host

macro: `hostlist` = host1,host2,host3,host4

Error: "Field 'host' does not exist in the data"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...