Getting Data In

Is there an SPL command using REST to list the macros contained within a macro?

kdwsplunk
Explorer

Hello, I see that we can use SPL to get a list of arguments, "args", of a macro using the "rest" command.

| rest /services/configs/conf-macros

It would be great to be able to list all the dependencies of a macro.


In particular, is there a way to use the "rest" command to get a list of macros depended upon by another macro?


For instance, is it possible to get the following output? (See the third column "macros_called_by_macro".)

|---- args ----|---- title ----|---- macros_called_by_macro ---| --- author --- | --- definition --- |
|              |     macro_01  |    macro_02, macro_03         |
|              |     macro_02  |    macro_04                   |
|              |     macro_03  |                               |

Thanks so much!!!

somesoni2
SplunkTrust
SplunkTrust

AFAIK, there are no such rest end point, not event for other knowledge objects (e.g. saved searches, dashboards etc) which will list dependencies. The rest queries just give details about current object. You probably have to parse it's definition to find any other macro invocation and then run some stats to get the table you expect.

DalJeanis
SplunkTrust
SplunkTrust

Try this...

| rest /services/configs/conf-macros 
| rex field=definition max_match=0 "\`(?<themacros>[^\`\(]*)[\`\(]" 
| rex field=id "(?<title>[^\/]*)$"
| table args title them* author definition

Then, depending on what you want to do next, you could put commas between the multiple values...

| eval themacros=mvjoin(themacros,", ")

kdwsplunk
Explorer

Thank you for your suggestion. ...Great approach!

I tried it and found that the REGEX on line #2 above just needs an adjustment because sometimes it grabs more than just the macro name. I'm currently getting up-to-speed on REGEX so that I can post an adjustment. I only have a partial suggestion at the moment. This suggestion grabs the macro name as well as the macro argument:

2. | rex field=definition max_match=0 "\`(?<themacros>[^`]*)\`"

I would like to figure out how to get rid of the argument (that is, the parentheses that follow the macro name, as well as the contents of the parentheses.

For example, the current result is:

macro_name(macro_argument)

But I would like to get the following result:

macro_name

Thank you again for your approach! Very nice!!!

0 Karma

landen99
Motivator
`(?<!\)`)(?<macros>[a-zA-Z][^`\(]*)[\(`]
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...