Splunk Search

searchmatch with macro expansion

klee310
Communicator

Hello & merry xmas to all,

I would like to create a macro-expansion using searchmatch (eval-command) such that the argument to searchmatch is expanded from an argument. Here is an example:

[macro1(1)]
definition = | eval YN=if(searchmatch($arg1$),"Y","N")
...

so from Splunk, I might use the macro like this:

... | eval foo="bar&baz&alpha" | eval foo=replace(foo,"&"," AND ") `macro1(foo)`

note, the illustration of foo="bar&baz&alpha" is just an example; in my real usage, the value of foo is retreived from a lookup-table, therefore the number of '&' contained within varies

the error I get is as follows:

Error in 'eval' command: The arguments to the 'searchmatch' function are invalid.

Can this be done?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Calling a macro like that isn't going to work. Expanding macros is done by string substitution before the search is run. The field foo is computed while the search is run, so that cannot be used by macro expansion.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Calling a macro like that isn't going to work. Expanding macros is done by string substitution before the search is run. The field foo is computed while the search is run, so that cannot be used by macro expansion.

View solution in original post

0 Karma

klee310
Communicator

furthermore, I have tried to simplify the entire problem by moving the searchmatch out of the macro:

... | eval foo="bar&baz&alpha" | eval foo=replace(foo,"&"," AND ") | eval YN=if(searchmatch(foo),"Y","N")

and still I get the same error, and ideas?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!