Splunk Search

How to use macros to search data and persist data?

jamin358
Explorer

I'm creating a bunch of status dashboards where I need to search for a specific set of hosts and persist a result (adding null value later)

I want to use the same macros to keep my search sizes down.

I want to have searches that look like this 

 

 

index=main host IN (`listofhosts`) 
| do some filtering 
| append [| makeresults | eval host = "`listofhosts`" | eval state=0 | makemv delim="," host | mvexpand host | fields host state] 
| stats first(*) AS * by host 
| do some more cool stuff

 

 

 I know that my hosts don't have spaces in them, so I figure I can write `listofhosts` as

 

 

host1,host2,host3,host4

 

 

without quotes so the host search at the top will work. But "`listofhosts`" does call the macro (because its in a string).

So, is there any way to call a macro within the body of a string?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You don't need to invoke the macro from within a string.  Just build a quoted string around the macro.

| eval host = "\"" . `listofhosts` . "\""
---
If this reply helps you, Karma would be appreciated.
0 Karma

jamin358
Explorer

Unfortunately this work

| makeresults | eval host="\"" . `hostlist` . "\"" | makemv delim="," host | mvexpand host | fields host

macro: `hostlist` = host1,host2,host3,host4

Error: "Field 'host' does not exist in the data"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yeah, I gave you bad advice.  Sorry about that.  That trick works with a field, but not necessarily with a macro.

The problem is macros are expanded before the command is executed.  That means 

 

eval host=`hostlist`

 

becomes

 

| eval host=host1,host2,host3

 

which is invalid.

Can you change the macro to contain a space-separated list of host names rather than a comma-separated list?  Either will work with the IN operator.  If so, this works

 

| makeresults 
| foreach `hostlist` [eval host=mvappend(host,"<<FIELD>>")]
| mvexpand host 
| fields host

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...