All Apps and Add-ons

Is it possible to create a macro to do this?

metersk
Path Finder

We use Splunk as our A/B platform. Our test buckets are called "studies", and within each study we have "groups", which are the different A/B tests.

Anytime we want to query a study to compare results across all the groups within the study we have to create a query like the following:

msg=single_message reply=1 plat=2 OR plat=0 | extract kvdelim="=" limit=200 pairdelim="," | makemv delim="," studies | chart count by studies,is_p | rex field=studies "(?.)---(?.)" | where study="lab"

The bolded text above is what is required to break out a study by its groups. Is there any way to turn this into a macro, with the caveat that within where study="lab" where "lab" and "chart count by studies,is_p" can be changed to anything (because we have multiple studies)?

0 Karma
1 Solution

lguinn2
Legend

If all of the events are the same sourcetype, you could do this in props.conf and transforms.conf, and not have to put it into your searches at all...

Assume the sourcetype name is "study":

props.conf

[study]
KV_MODE=auto
REPORT-study1=extract-study-fields

transforms.conf

[extract-study-fields]
MV_ADD = true
DELIMS = ",", "="
FORMAT = $1::$2

I think this may be all you need. Your search would then be

msg=single_message reply=1 plat=2 OR plat=0 
| chart count by studies,is_p  
| where isnotnull(mvfind(studies,"lab"))

View solution in original post

lguinn2
Legend

If all of the events are the same sourcetype, you could do this in props.conf and transforms.conf, and not have to put it into your searches at all...

Assume the sourcetype name is "study":

props.conf

[study]
KV_MODE=auto
REPORT-study1=extract-study-fields

transforms.conf

[extract-study-fields]
MV_ADD = true
DELIMS = ",", "="
FORMAT = $1::$2

I think this may be all you need. Your search would then be

msg=single_message reply=1 plat=2 OR plat=0 
| chart count by studies,is_p  
| where isnotnull(mvfind(studies,"lab"))
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...