Knowledge Management

macro question - how to use the macro search results to another search?

crt89
Communicator

Good day fellow Splunkers,

I'm new to this macro in Splunk and I want to ask if this could be possible.

I have 3 monitored folders, I want to start my search to just get the latest source of this 3 folders. So I was thinking can I do a macro search to first filter my sources. 1 for each directory. So I will only have 3 sources to search for my search string.

The problem is I dont know how to configure the macro to pass the results of the macro search to a variable that I will be using for my search.

my sample macro would be:

host=host1 | stats latest(source) as host1_source_latest
(same for the other 2 directory)

then my search would be source=[the results of the macro] | [my search string]

This is what I'm planning to do, if there would be other approach it would be much appreciated.

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use macros in subsearches as you normally would in non-sub-searches. For example, if you have this search

my search string [search host=host1 | head 1 | fields source]

where the subsearch will be evaluated to source=foo, you can replace the inner contents of the subsearch with a call to a macro. It could then look something like this:

my search string [`macro`]

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can use macros in subsearches as you normally would in non-sub-searches. For example, if you have this search

my search string [search host=host1 | head 1 | fields source]

where the subsearch will be evaluated to source=foo, you can replace the inner contents of the subsearch with a call to a macro. It could then look something like this:

my search string [`macro`]

crt89
Communicator

edit: forgot to change query strings. solved now. Thanks again

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Note, I have modified the subsearch - should be a much faster way to grab the latest source.

0 Karma

crt89
Communicator

I have tried it and it works. Thank its a nice start for me to make use of macros.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...