Hi all, I have a question about macros: suppose I must use, inside a search, multiple macros. Those macros can be related between them by simple logical condition like AND and OR; what is the r...
Hi All,
i kind of already have this working but wondering what else can be done with this?what other approaches i can implement?
So,In order to simplify analysis I have been testing a searchmacro...
So I have a macro that has a field variable that I want to use a wildcard and worse the field names tend to have dots. So a good field would be body.system.diskio.write.bytes and I tried u...
...ork
Macro definition
eval desc=desc+ if(floor($bitField$/2)%2>0,"That Text, ","") | eval desc=desc+ if(floor($bitField$/2)%2>0,"That Text, ","")
This search does not work t...
...ookup.
I created a searchmacro that accepts the email address and returns the stats I need. This work fine when used in the search bar like EmailStats("john.doe@mycompany.com")
Macro:
in...
Hi Guys,
Is it possible to calculate the name of a macro to be used in a search from a token value?
I have a drop down list of system names that I have corresponding macros for.
eg
k...
Hi all,
I am trying to use a variable as a search condition based on input in a text box. In order to make it simpler for users, I want them to be able to enter as many potential search strings a...
Hello,
I am trying to run a macro multiple times in a search. If the search returns 10 results, the macro should run 10 times. Is there a way to achieve this?
I don't want to use 'map' c...
Good day fellow Splunkers,
I'm new to this macroin Splunk and I want to ask if this could be possible.
I have 3 monitored folders, I want to start my search to just get the latest source of t...
Right now I have a lot of macros to help with reports, dashboards and knowledge items in general. We do not really use tags/eventtypes. Right now though each business has multiple macros that need t...