Create "Self-help" userlist to be monitored as a macro?

[petelam]

Hi, our user has a need to monitor a number of user logon activities. The user list is relatively static. So, I have created a dashboard for them to monitor these users activities.

However, this user list will now change over time..., but still relatively static. I would like the user to maintain their user list externally and my search will take on this list. I am thinking of using a macro... So, I would like to know if there is a way to create a "self-help" macro and my dashboard will just consume this "self-help" macro of user list? Or is there other options that can achieve the same result?

[dwaddle]

Yes, a macro would work, but you'd obviously need to maintain the macro. You might find a better solution to be sucking in a lookup table using inputlookup. The solution would look something like this:

1. Create a lookup table, call it monitored_users.csv and put it in $SPLUNK_HOME/etc/system/lookups. Make the contents something like the example below
2. Update your dashboard to pull this lookup in via subsearch
3. Profit!

Example monitored_users.csv:

user_name
cartman
kenny
kyle
stan
butters
timmay

Example search for dashboard:

[ | inputlookup monitored_users.csv | fields user_name ] _the_rest_of_your_search_

The way this winds up working is that the subsearch's output gets interpolated into the main search similar to:

( user_name="cartman" ) OR ( user_name="kenny" ) OR ( user_name="kyle" ) OR
( user_name="stan" ) OR ( user_name="butters" ) OR ( user_name="timmay )
_the_rest_of_your_search_

The rules for this interpolation are governed by how subsearches work in conjunction with the format search command (which is called implicitly in your subsearch unless you call it explicitly)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork