My main query looks like:
...| stats min(_time) AS SESSION_START_TIME max(Source_Network_Address) AS EMP_SRC_IP...
| eval empID=`my_macro($EMP_SRC_IP$, $SESSION_START_TIME $)`
My macro definition is:
index=my_idx event.eventID=4624 event.Come_From=$ip_address$ latest=$time$ | sort - _time | head 1| table event.Who_Is_It
My questions are:
1. How can I make my macro, my_macro, returns a String which is the value of event.Who_IS_It ?
2. Is the way I assign the macro returned value to param name empID is the right way?
The query works great if I pass to the macro values and not params:
trim(`my_macro("8.8.8.8", 1642031990)`) but once try to use params I get the errors
How are you passing the parameters?
eval empID=trim(`my_macro(EMP_SRC_IP, SESSION_START_TIME)`)
My query looks like:
... | stats min(_time) AS SESSION_START_TIME max(Source_Network_Address) AS EMP_SRC_IP ... | eval empID=trim(`my_macro($EMP_SRC_IP$, $SESSION_START_TIME$)`)
I found the issue: The macro should be a little different:
[search index=my_idx event.eventID=4624 event.Come_From=$ip_address$ latest=$time$ | sort - _time | head 1 | rename "event.Who_Is_It" as query | fields query | format "\"" "" "" "" "" "\"" | table search]
The problem now is that I get error passing parameters.
| eval empID=trim(`my_macro($EMP_SRC_IP$, $SESSION_START_TIME $)`)
Invalid value "$SESSION_START_TIME$" for time term 'latest'
Any idea what is wrong?
You don't need $ around the field names you are passing into the macro
| eval empID=trim(`my_macro(EMP_SRC_IP, SESSION_START_TIME)`)
After removing the $ I get the following error:
Invalid value "SESSION_START_TIME" for time term 'latest'
I created the macro as a subsearch as you suggested below:
[search index=my_idx event.eventID=4624 event.Come_From=$ip_address$ latest=$time$ | sort - _time | head 1 | table 'event.Who_Is_It' | rename "event.Who_Is_It" as query | fields query | format "\"" "" "" "" "" "\""]
and when I call it on Splunk UI :
`my_macro($EMP_SRC_IP$, $SESSION_START_TIME $)`
I got the results I mentioned above
On the splunk search UI call it like this
| makeresults
| eval empID=trim(`my_macro($EMP_SRC_IP$, $SESSION_START_TIME $)`)
Try setting your macro up like this:
[search index=my_idx event.eventID=4624 event.Come_From=$ip_address$ latest=$time$
| sort - _time
| head 1
| table 'event.Who_Is_It'
| rename "event.Who_Is_It" as query | fields query | format "\"" "" "" "" "" "\""]
You may also need to trim the result
| eval empID=trim(`my_macro($EMP_SRC_IP$, $SESSION_START_TIME $)`)
Something strange is going on. When I run the query of the macro as you suggested on Splunk UI (as a subsearch) I got zero results back. If I remove the last part of "| rename" I got 11 results back as if it ignore the "| head 1". When I run it NOT as a subsearch I got one result as expected.
What should I do to fix it?
Why is that?
What do you mean "as a subsearch"? Can you share exactly what you have in the search in a code block </>