Splunk Search

Why do I need a | when using a macro with a generating command?

cvg1wby
Explorer

I have a macro that starts with a search command.  When I ran it, I noticed I was getting a different number of results than if I just ran the raw SPL vs using the macro.

As an example my macro was named open_vulnerabilities and the SPL was:

 

 

 

search index="vulnerabilities" severity_id>=2 state!="fixed"

 

 

 

If I use the macro in the search bar like this:

 

 

 

`open_vulnerabilities`

 

 

 

I would get say 10 results.  But if I ran the full SPL (index="vulnerabilities"...) then I'd get 100 results.

I ended up figuring out that if I used a | before the macro name, like this

 

 

 

| `open_vulnerabilities`

 

 

 

 then I'd get the number of results I expected.  I just don't understand why. 

If I got 0 results, then it would make some sense but the fact that it's returning 10 really has me stumped.  Any help would be greatly appreciated.  Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cvg1wby
Explorer

Thanks.  I haven't used that before and it was pretty helpful.   Turns out the extra search was the problem.  It was doing this under the hood

| (search index="vulnerabilities" severity_id>=2 state!="fixed") search

 

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...