Splunk Search

How to use macros to search data and persist data?

jamin358
Explorer

I'm creating a bunch of status dashboards where I need to search for a specific set of hosts and persist a result (adding null value later)

I want to use the same macros to keep my search sizes down.

I want to have searches that look like this 

 

 

index=main host IN (`listofhosts`) 
| do some filtering 
| append [| makeresults | eval host = "`listofhosts`" | eval state=0 | makemv delim="," host | mvexpand host | fields host state] 
| stats first(*) AS * by host 
| do some more cool stuff

 

 

 I know that my hosts don't have spaces in them, so I figure I can write `listofhosts` as

 

 

host1,host2,host3,host4

 

 

without quotes so the host search at the top will work. But "`listofhosts`" does call the macro (because its in a string).

So, is there any way to call a macro within the body of a string?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You don't need to invoke the macro from within a string.  Just build a quoted string around the macro.

| eval host = "\"" . `listofhosts` . "\""
---
If this reply helps you, Karma would be appreciated.
0 Karma

jamin358
Explorer

Unfortunately this work

| makeresults | eval host="\"" . `hostlist` . "\"" | makemv delim="," host | mvexpand host | fields host

macro: `hostlist` = host1,host2,host3,host4

Error: "Field 'host' does not exist in the data"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...