Splunk Search

Macro returns no result when applied

klausJohan
Path Finder

Hello,

Could someone explain what am I doing wrong in using a macro ?

Here is the macros.conf file

[GET_IP]
definition = 127.0.0.1

The search query I intend to use is :

source="mySource" AND object.ip_address='GET_IP'

However, if I paste the above query in the search bar I obtain no result . On the other hand if I do the same thing for the expanded query (source="mySource" AND object.ip_address=127.0.0.1) I get all the events back .

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You need to use backticks, not quotes, and probably make it eval macro.

macros.conf
[GET_IP]
definition = "\"127.0.0.1\""
iseval = true


source="mySource" object.ip_address=GET_IP

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

You need to use backticks, not quotes, and probably make it eval macro.

macros.conf
[GET_IP]
definition = "\"127.0.0.1\""
iseval = true


source="mySource" object.ip_address=GET_IP

klausJohan
Path Finder

Thanks .Worked with : definition = "127.0.0.1"

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

try your initial definition.

0 Karma

klausJohan
Path Finder

Thanks. I'm still getting an error back . This time is "Error in 'SearchParser': The definition of macro 'GET_IP' is expected to be an eval expression that returns a string"

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

try this url: http://your_splunk:8000/en-US/debug/refresh/?entity=admin/macros and then try your search again.

0 Karma

klausJohan
Path Finder

The "backtip " opened my eyes about how to properly use a macro in a search. Now I obtain an error : Error in 'SearchParser': Could not find macro 'GET_IP' that takes 0 arguments. Expecting stanza name 'GET_IP'.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...