Splunk Search

Why do I need a | when using a macro with a generating command?

cvg1wby
Explorer

I have a macro that starts with a search command.  When I ran it, I noticed I was getting a different number of results than if I just ran the raw SPL vs using the macro.

As an example my macro was named open_vulnerabilities and the SPL was:

 

 

 

search index="vulnerabilities" severity_id>=2 state!="fixed"

 

 

 

If I use the macro in the search bar like this:

 

 

 

`open_vulnerabilities`

 

 

 

I would get say 10 results.  But if I ran the full SPL (index="vulnerabilities"...) then I'd get 100 results.

I ended up figuring out that if I used a | before the macro name, like this

 

 

 

| `open_vulnerabilities`

 

 

 

 then I'd get the number of results I expected.  I just don't understand why. 

If I got 0 results, then it would make some sense but the fact that it's returning 10 really has me stumped.  Any help would be greatly appreciated.  Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is when the Job Inspector is your friend.  Check the optimizedSearch and litSearch values for each query to see what Splunk is doing under the covers.

FWIW, the search keyword probably is not needed in a macro, but it depends on how you expect to use it.  If it will be the start of a query then the search command is implied.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cvg1wby
Explorer

Thanks.  I haven't used that before and it was pretty helpful.   Turns out the extra search was the problem.  It was doing this under the hood

| (search index="vulnerabilities" severity_id>=2 state!="fixed") search

 

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...