Splunk Search

Usage of fieldname and field value for a foreach macro

esmond
Engager

Hi,

I am trying to produce a macro with an event summary that would contain both the field name and field value and a single field

my query is as follows:

 

| makeresults 
| eval time="2020-10-05 05:44:27" 
| eval file="Generic.exe" 
| eval signature="Generic" 
| eval Event_Summary="" 
| foreach time file signature 
    [ eval Event_Summary=Event_Summary."|"."<<FIELD>>".": ".'<<FIELD>>'] 
| eval Event_Summary=split(Event_Summary,"|")

 

how do i make the macro such that the arguments i throw in, will become the fields in the foreach statement?
The macro i have tried to create is :

 

| eval Event_Summary=""
| foreach $fields$
    [ eval Event_Summary=Event_Summary."|"."<<FIELD>>".": ".'<<FIELD>>']
| eval Event_Summary=split(Event_Summary,"|")

 

Hoping to achieve the below:

 

| makeresults 
| eval time="2020-10-05 05:44:27" 
| eval file="Generic.exe" 
| eval signature="Generic" 
| eval fields="time file signature"
`Summarize(fields)`
|table Event_Summary

 

But i can't figure out how to change the argument string to fields

Edit:

one more condition is that i would want the macro to be flexible in being able to take in any number of fields and not just a fixed number of 3 fields/arguments.

 

Labels (2)
0 Karma

thambisetty
SplunkTrust
SplunkTrust
| makeresults 
| eval time="2020-10-05 05:44:27" 
| eval file="Generic.exe" 
| eval signature="Generic" 
`foreachFields(_time,signature,file)`
|table Event_Summary

you can rename the macro name as you wish.

thambisetty_0-1601884304321.png

 

————————————
If this helps, give a like below.

esmond
Engager

Hi Thambisetty,

Thanks for your reply, i neglected to include another condition, that i would want the macro to be flexible in being able to take in any number of fields and not just a fixed number of 3

I have updated my original post.

You solution does work for a fixed number of 3 arguments, perhaps would you be able to figure out with my additional condition? hehe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...