Splunk Search

Why do I need a | when using a macro with a generating command?

cvg1wby
Engager

I have a macro that starts with a search command.  When I ran it, I noticed I was getting a different number of results than if I just ran the raw SPL vs using the macro.

As an example my macro was named open_vulnerabilities and the SPL was:

 

 

 

search index="vulnerabilities" severity_id>=2 state!="fixed"

 

 

 

If I use the macro in the search bar like this:

 

 

 

`open_vulnerabilities`

 

 

 

I would get say 10 results.  But if I ran the full SPL (index="vulnerabilities"...) then I'd get 100 results.

I ended up figuring out that if I used a | before the macro name, like this

 

 

 

| `open_vulnerabilities`

 

 

 

 then I'd get the number of results I expected.  I just don't understand why. 

If I got 0 results, then it would make some sense but the fact that it's returning 10 really has me stumped.  Any help would be greatly appreciated.  Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cvg1wby
Engager

Thanks.  I haven't used that before and it was pretty helpful.   Turns out the extra search was the problem.  It was doing this under the hood

| (search index="vulnerabilities" severity_id>=2 state!="fixed") search

 

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...