Splunk Search

Run macro commands from lookup

apiprek2
Explorer

Hi

I'm wondering if it's possible to define and execute a macro from a lookup.  I have an index with several (about 50) user actions, which aren't named in a user friendly manner.  Additionally, each action has different fields, which I'd like to extract using inline rex queries.  In short, I'd like a table with the following:

TimeUserNameMessage
10:00 a.m.JohnDoeThis is action1.  Details for action1.
10:01 a.m.JohnDoeThis is action2.  Details for action2.
10:02 a.m. JohnDoeThis is action3.  Details for action3.

 

I know can define a friendly name for the action using a lookup.  I can also do the rex field extractions and compose a details field using a macro for each action.  However, is there a way to also rex the fields and define the details in a lookup?  

I was thinking of creating a lookup like this:

ActionFriendlyDescriptionMacroDefinition
action1"This is action1"| rex to extract fields for action1 | eval for Details for action1
action2"This is action2"| rex to extract fields for action2 | eval for Details for action2
action3"This is action3"| rex to extract fields for action3 | eval for Details for action3

 

I was thinking about something like this:

 

index=MyIndex source=MySource

| lookup MyLookup.csv ActionId OUTPUT FriendlyDescription, MacroDefinition

`code to execute MacroDefinition`

|table _time, UserName, FriendlyDescription, Details for action

 

I'm not sure if i'm barking up the wrong tree, but the reason I'd like to do this in one place (a lookup) instead of 50 different macro definitions.  It'd be neat to have all the code in one place.

Thanks!

 

 

 

 

 

 

Labels (1)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Macros are expanded before the resultant SPL is parsed and executed which probably means that macros stored in a lookup are not expanded.

0 Karma

apiprek2
Explorer

That's what i'm finding as well.  I'm curious if there's a round-about way to do this.  Maybe using that string as a token in a dashboard?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...