Snippet of search
SEARCH
| eval runmacro = if(deltadif="NO","TurnTimeRecovered
","TurnTimeWarning
")
runmacro
comment(" +++++++++TurnTimeWarning
| where alertnamecount>0
| where alertnamecount=(count+1)
+++++++++++++++ ")
comment(" +++++++++TurnTimeRecovered
| where alertnamecount=0
| head 1
| where count=1
| where deltadif = "NO"
++++++++++++ ")
The macros exist and the comments above are the exact macros. From the 'deltadif' value I need to perform one of the above macros. This runs successfully, but it appears the macro is not executing. When I run each one inline, they function as expected, but require a unique search for each.
Can a variable be set as a macro and be called; if so how? Or is there a better solution?
Yes, like this:
.... | eval runmacro = if(deltadif="NO","`TurnTimeRecovered`","`TurnTimeWarning`")
| map search="search Other Stuff Here | `$runmacro$`"
Yes, like this:
.... | eval runmacro = if(deltadif="NO","`TurnTimeRecovered`","`TurnTimeWarning`")
| map search="search Other Stuff Here | `$runmacro$`"
You can turn this inside-out and do the same thing with a subsearch
:
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchTutorial/Useasubsearch
The 2 templatizing approaches are map
and subsearch
.
That's what I wasn't considering -- running separate search. Thanks for the guidance; it does appear to give me what I'm looking for.