Splunk Search

searchmatch with macro expansion

klee310
Communicator

Hello & merry xmas to all,

I would like to create a macro-expansion using searchmatch (eval-command) such that the argument to searchmatch is expanded from an argument. Here is an example:

[macro1(1)]
definition = | eval YN=if(searchmatch($arg1$),"Y","N")
...

so from Splunk, I might use the macro like this:

... | eval foo="bar&baz&alpha" | eval foo=replace(foo,"&"," AND ") `macro1(foo)`

note, the illustration of foo="bar&baz&alpha" is just an example; in my real usage, the value of foo is retreived from a lookup-table, therefore the number of '&' contained within varies

the error I get is as follows:

Error in 'eval' command: The arguments to the 'searchmatch' function are invalid.

Can this be done?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Calling a macro like that isn't going to work. Expanding macros is done by string substitution before the search is run. The field foo is computed while the search is run, so that cannot be used by macro expansion.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Calling a macro like that isn't going to work. Expanding macros is done by string substitution before the search is run. The field foo is computed while the search is run, so that cannot be used by macro expansion.

0 Karma

klee310
Communicator

furthermore, I have tried to simplify the entire problem by moving the searchmatch out of the macro:

... | eval foo="bar&baz&alpha" | eval foo=replace(foo,"&"," AND ") | eval YN=if(searchmatch(foo),"Y","N")

and still I get the same error, and ideas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...