Hi, I'm struggling with using subsearches in eval statements, but got most of it worked out. Now I want to put the subsearch into a macro for obvious reasons, but it seems the macro doesn't expand the arguments passed to it ... My iseval macro looks something like this: "[ search index=main | head 1 | eval ip=\"$dnsip$\" | lookup local=true dnslookup dnsip as ip output dnshost as result | fillnull value=\"null\" | eval result=\"\\\"\".result.\"\\\"\" | return $result ]" It's doing a dummy search to calculate the hostname for a given IP, and then returning that hostname formatted as a string to the eval expression. This works perfectly fine if I invoke the macro like this: index=main | head 1 | eval aatest=`test_dnshost("8.8.8.8")` It gets nicely expanded: 06-04-2015 10:19:55.462 INFO SearchParser - PARSING: search index=main | head 1 | eval aatest=`test_dnshost("8.8.8.8")` 06-04-2015 10:19:55.465 INFO SearchParser - AFTER EXPANDING MACROS: search index=main | head 1 | eval aatest=[ search index=main | head 1 | eval ip="8.8.8.8" | lookup local=true dnslookup dnsip as ip output dnshost as result | fillnull value="null" | eval result="\"".result."\"" | return $result ] But when I try to pass actual variables to this macro, it suddenly doesn't want to expand the argument anymore. The search string is: index=main | head 1 | eval ip="8.8.8.8" | eval aatest=`test_dnshost(ip)` which seems to expand with "ip" as an argument value, not the actual field content: 06-04-2015 10:23:18.642 INFO SearchParser - PARSING: search index=main | head 1 | eval ip="8.8.8.8" | eval aatest=`test_dnshost(ip)` 06-04-2015 10:23:18.644 INFO SearchParser - AFTER EXPANDING MACROS: search index=main | head 1 | eval ip="8.8.8.8" | eval aatest=[ search index=main | head 1 | eval ip="ip" | lookup local=true dnslookup dnsip as ip output dnshost as result | fillnull value="null" | eval result="\"".result."\"" | return $result ] Any clue why and how i might fix this? ... View more

Hi, I'm trying to calculate a value through some lookup statements and then put that value into a variable using eval. I've been googling and reading documentation for a while now and "return" seems the way to go, but I can't get it to work. Basically what I want to do is: somesearch | eval somevar=[ subsearch | lookup | return $lookupresult ] But whatever I try, I never get the "somevar" field in my resulting events. I tried boiling it down to a very simple dummy query to test this, but even this does not return any "aatest" field in the resulting event: index=main | head 1 | eval aatest=[ search index=main | head 1 | eval ip="test" | return $ip ] As I understand it, this should just return the "aatest" field with value "test" in the 1 resulting event, no? Thanks! ... View more

Hi, I'm running a test setup with some live syslog data and I want to do the following on my forwarder: 1) Route all data matching a certain regex to a specific index on my indexer 2) Drop all other events I already have been playing around with the _MetaData:Index key which seems to work just fine when applied as single transform for a certain source. However, combining it with a general drop transform seems to be different. This is my props.conf, with the transforms in the order the documentation is telling me to put them (http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest): [source::/var/log/splunk*] TRANSFORMS-syslog = drop,test When testing the same syntax as mentioned in the doc, the filtering works and all events matching the "test" transform get sent to the main index: [drop] REGEX = . DEST_KEY = queue FORMAT = nullQueue [test] REGEX = <regex> DEST_KEY = queue FORMAT = indexQueue However, when I want to route to the test index, the "test" transform just doesn't seem to get applied. All data is dropped since my indexes remain empty. transforms.conf in that case: [drop] REGEX = . DEST_KEY = queue FORMAT = nullQueue [test] REGEX = <regex> DEST_KEY = _MetaData:Index FORMAT = test Is combining these two transforms possible? If yes, how? Or do I need to route the filtered data to the indexQueue and then route it again to the correct index somewhere else? ... View more