Splunk Search

Usage of fieldname and field value for a foreach macro

esmond
Engager

Hi,

I am trying to produce a macro with an event summary that would contain both the field name and field value and a single field

my query is as follows:

 

| makeresults 
| eval time="2020-10-05 05:44:27" 
| eval file="Generic.exe" 
| eval signature="Generic" 
| eval Event_Summary="" 
| foreach time file signature 
    [ eval Event_Summary=Event_Summary."|"."<<FIELD>>".": ".'<<FIELD>>'] 
| eval Event_Summary=split(Event_Summary,"|")

 

how do i make the macro such that the arguments i throw in, will become the fields in the foreach statement?
The macro i have tried to create is :

 

| eval Event_Summary=""
| foreach $fields$
    [ eval Event_Summary=Event_Summary."|"."<<FIELD>>".": ".'<<FIELD>>']
| eval Event_Summary=split(Event_Summary,"|")

 

Hoping to achieve the below:

 

| makeresults 
| eval time="2020-10-05 05:44:27" 
| eval file="Generic.exe" 
| eval signature="Generic" 
| eval fields="time file signature"
`Summarize(fields)`
|table Event_Summary

 

But i can't figure out how to change the argument string to fields

Edit:

one more condition is that i would want the macro to be flexible in being able to take in any number of fields and not just a fixed number of 3 fields/arguments.

 

Labels (2)
0 Karma

thambisetty
SplunkTrust
SplunkTrust
| makeresults 
| eval time="2020-10-05 05:44:27" 
| eval file="Generic.exe" 
| eval signature="Generic" 
`foreachFields(_time,signature,file)`
|table Event_Summary

you can rename the macro name as you wish.

thambisetty_0-1601884304321.png

 

————————————
If this helps, give a like below.

esmond
Engager

Hi Thambisetty,

Thanks for your reply, i neglected to include another condition, that i would want the macro to be flexible in being able to take in any number of fields and not just a fixed number of 3

I have updated my original post.

You solution does work for a fixed number of 3 arguments, perhaps would you be able to figure out with my additional condition? hehe

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...