Search
  • Todd Waller

Splunk - using search macros

Hello again everyone! Todays post we demonstrate using search macros and how to create them to make searching easier. In todays example I will reuse some old blog data from a previous post.


So imagine we have a number of log records from a log we are monitoring and we want to count the number of logs by the extracted host name, like this:



As you can see in this example there are 15 records but only 5 have an extracted_Host, the problem is that this will throw our total count off.





So if I want to include all records in the Total I need to add in a fillnull value, like this:



But typing the whole fillnull line can be repetitive so we can simplify this by creating a search macro. Go to Settings -> Advanced search -> Search macros adn select New Search Macro. Enter the necessary information for your macro. For this example here is the macro I created:



Now we should be able to go back to the search and add "`fillnull(None, extracted_Host)`" and search again and you would get the same results.



Now you don't have to enter the "fillnull value=None extracted_Host" line you can just replace it like above AND this re-usable so if you need to do this to another field, for example "User" as user may not exist for each record, you could simply use "`fillnull(None, User)` "



Hope this helps you make searching simpler for your clients and yourself. Macros can come in really handy in many circumstances. Have a great week!


46 views0 comments

Recent Posts

See All

How do I learn Splunk administration?

Had an old coworker hit me up a week ago. He took a job as a SOC analyst where part of his job is going to be supporting Splunk. He's a smart guy but Splunk is more complex than it looks. Given I've a