Splunk Search

how to insert a macro name as field value if the results on the search match to a macro?

pavanae
Builder

I have a query which displays some statistical results. Now I want to add a column macro_match which contains the matching macro.

like as shown below

macro_match
macro_1
macro_2

is it possible in splunk ?

I tried using the searchmatch and inserted the macro in it instead of the search string as shown below which doesn't worked.

| eval macro_match= case(searchmatch("`macro_1`"),"macro_1", searchmatch("`macro_2`"),"macro_2", true(), "None")
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi pavanae,

If I understand it correctly then you don't match on the macro command

  `macroNameHere`

but just on the string of the name like:

  | eval macro_match= case(searchmatch("macro_1"),"macro_1", searchmatch("macro_2"),"macro_2", true(), "None")

If you intend to call and run a macro this way, I don't think that is possible out of the box ... but might be wrong on that for the latest version of Splunk ¯\_(ツ)_/¯

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi pavanae,

If I understand it correctly then you don't match on the macro command

  `macroNameHere`

but just on the string of the name like:

  | eval macro_match= case(searchmatch("macro_1"),"macro_1", searchmatch("macro_2"),"macro_2", true(), "None")

If you intend to call and run a macro this way, I don't think that is possible out of the box ... but might be wrong on that for the latest version of Splunk ¯\_(ツ)_/¯

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...