[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:00.03,0:00:02.94,Default,,0000,0000,0000,,okay today we will discuss about plan
Dialogue: 0,0:00:02.94,0:00:06.24,Default,,0000,0000,0000,,macros okay so his plan macros you can
Dialogue: 0,0:00:06.24,0:00:09.09,Default,,0000,0000,0000,,think of it as a reusable component in
Dialogue: 0,0:00:09.09,0:00:12.96,Default,,0000,0000,0000,,your Splunk search where suppose a
Dialogue: 0,0:00:12.96,0:00:15.87,Default,,0000,0000,0000,,particular search portion if it is using
Dialogue: 0,0:00:15.87,0:00:18.93,Default,,0000,0000,0000,,if you are using many times mmm then you
Dialogue: 0,0:00:18.93,0:00:20.46,Default,,0000,0000,0000,,can put it in a macro so that you can
Dialogue: 0,0:00:20.46,0:00:23.58,Default,,0000,0000,0000,,call that micro and the macro will be
Dialogue: 0,0:00:23.58,0:00:26.31,Default,,0000,0000,0000,,replaced runtime with that search string
Dialogue: 0,0:00:26.31,0:00:28.92,Default,,0000,0000,0000,,okay so macros are very very useful when
Dialogue: 0,0:00:28.92,0:00:31.89,Default,,0000,0000,0000,,suppose you have many dashboards in your
Dialogue: 0,0:00:31.89,0:00:34.59,Default,,0000,0000,0000,,application and in all this - but you
Dialogue: 0,0:00:34.59,0:00:38.67,Default,,0000,0000,0000,,have some search which is running in all
Dialogue: 0,0:00:38.67,0:00:41.61,Default,,0000,0000,0000,,the - boots right so in this case you
Dialogue: 0,0:00:41.61,0:00:43.41,Default,,0000,0000,0000,,can implement that such portion in a
Dialogue: 0,0:00:43.41,0:00:45.68,Default,,0000,0000,0000,,macro where you can just call that macro
Dialogue: 0,0:00:45.68,0:00:47.85,Default,,0000,0000,0000,,instead of this whole search string in
Dialogue: 0,0:00:47.85,0:00:50.37,Default,,0000,0000,0000,,your dashboards so in the future if you
Dialogue: 0,0:00:50.37,0:00:52.44,Default,,0000,0000,0000,,want to do any changes in that search
Dialogue: 0,0:00:52.44,0:00:55.14,Default,,0000,0000,0000,,logic you will just change into the into
Dialogue: 0,0:00:55.14,0:00:58.53,Default,,0000,0000,0000,,one place in that in macro body okay so
Dialogue: 0,0:00:58.53,0:01:01.35,Default,,0000,0000,0000,,so by implementing macro basically we
Dialogue: 0,0:01:01.35,0:01:04.17,Default,,0000,0000,0000,,are achieving two things one is the
Dialogue: 0,0:01:04.17,0:01:06.93,Default,,0000,0000,0000,,modularity of your code easily
Dialogue: 0,0:01:06.93,0:01:09.63,Default,,0000,0000,0000,,maintaining of your code and as well as
Dialogue: 0,0:01:09.63,0:01:11.25,Default,,0000,0000,0000,,your search string will be very much
Dialogue: 0,0:01:11.25,0:01:15.72,Default,,0000,0000,0000,,smaller okay so there are there are
Dialogue: 0,0:01:15.72,0:01:18.69,Default,,0000,0000,0000,,couple - two different types of macro we
Dialogue: 0,0:01:18.69,0:01:20.58,Default,,0000,0000,0000,,generally deals with one is eval based
Dialogue: 0,0:01:20.58,0:01:23.19,Default,,0000,0000,0000,,macro and there is no an evil based
Dialogue: 0,0:01:23.19,0:01:26.40,Default,,0000,0000,0000,,macro so before we discuss those things
Dialogue: 0,0:01:26.40,0:01:29.79,Default,,0000,0000,0000,,let me show you the data I have it here
Dialogue: 0,0:01:29.79,0:01:32.91,Default,,0000,0000,0000,,so I have some people name and their
Dialogue: 0,0:01:32.91,0:01:36.27,Default,,0000,0000,0000,,basic salary and and variable percent so
Dialogue: 0,0:01:36.27,0:01:39.72,Default,,0000,0000,0000,,I'll show you to how to create evil
Dialogue: 0,0:01:39.72,0:01:42.42,Default,,0000,0000,0000,,waste macro how to create non evil West
Dialogue: 0,0:01:42.42,0:01:43.71,Default,,0000,0000,0000,,Metro and what are the differences
Dialogue: 0,0:01:43.71,0:01:47.94,Default,,0000,0000,0000,,between them and and then how to call
Dialogue: 0,0:01:47.94,0:01:49.86,Default,,0000,0000,0000,,macarons at a macro also we will try to
Dialogue: 0,0:01:49.86,0:01:52.47,Default,,0000,0000,0000,,discuss that one okay so first let us
Dialogue: 0,0:01:52.47,0:01:56.76,Default,,0000,0000,0000,,see how we can create a non evil macro
Dialogue: 0,0:01:56.76,0:02:00.41,Default,,0000,0000,0000,,so now an evil macro and honorable macro
Dialogue: 0,0:02:00.41,0:02:03.60,Default,,0000,0000,0000,,if you see functionality-wise both are
Dialogue: 0,0:02:03.60,0:02:07.02,Default,,0000,0000,0000,,same so when we define a macro the macro
Dialogue: 0,0:02:07.02,0:02:09.89,Default,,0000,0000,0000,,body you are giving this string right so
Dialogue: 0,0:02:09.89,0:02:12.90,Default,,0000,0000,0000,,dynamically in the run time
Dialogue: 0,0:02:12.90,0:02:15.67,Default,,0000,0000,0000,,macro will be definite will be replaced
Dialogue: 0,0:02:15.67,0:02:18.16,Default,,0000,0000,0000,,by that macro body by spelling search
Dialogue: 0,0:02:18.16,0:02:22.81,Default,,0000,0000,0000,,okay now when we talk about evil waste
Dialogue: 0,0:02:22.81,0:02:26.50,Default,,0000,0000,0000,,macro it is expected that the macro is
Dialogue: 0,0:02:26.50,0:02:29.89,Default,,0000,0000,0000,,returning a string when you use non evil
Dialogue: 0,0:02:29.89,0:02:32.14,Default,,0000,0000,0000,,waste macro you can directly put the
Dialogue: 0,0:02:32.14,0:02:34.21,Default,,0000,0000,0000,,search string inside the macro so let me
Dialogue: 0,0:02:34.21,0:02:37.24,Default,,0000,0000,0000,,show you suppose I wanted to calculate
Dialogue: 0,0:02:37.24,0:02:40.00,Default,,0000,0000,0000,,total salary based on this formula
Dialogue: 0,0:02:40.00,0:02:43.24,Default,,0000,0000,0000,,called basic salary let me show you
Dialogue: 0,0:02:43.24,0:02:50.34,Default,,0000,0000,0000,,basic salary plus basic into that
Dialogue: 0,0:02:50.34,0:02:54.16,Default,,0000,0000,0000,,percentage variable percentage variable
Dialogue: 0,0:02:54.16,0:02:58.39,Default,,0000,0000,0000,,percent okay so to do that to create any
Dialogue: 0,0:02:58.39,0:03:01.18,Default,,0000,0000,0000,,macro from the Splunk uy this is how you
Dialogue: 0,0:03:01.18,0:03:03.85,Default,,0000,0000,0000,,do it we'll go to settings we go to
Dialogue: 0,0:03:03.85,0:03:08.17,Default,,0000,0000,0000,,advanced search okay from there if you
Dialogue: 0,0:03:08.17,0:03:10.78,Default,,0000,0000,0000,,see there is a option called such Mac
Dialogue: 0,0:03:10.78,0:03:13.27,Default,,0000,0000,0000,,rooms you go there you select your app
Dialogue: 0,0:03:13.27,0:03:15.52,Default,,0000,0000,0000,,from there so I'll be creating this
Dialogue: 0,0:03:15.52,0:03:17.80,Default,,0000,0000,0000,,matter in my tmdb app so I have selected
Dialogue: 0,0:03:17.80,0:03:20.85,Default,,0000,0000,0000,,tmdb over here then new search macro
Dialogue: 0,0:03:20.85,0:03:23.71,Default,,0000,0000,0000,,okay if you see the destination I've
Dialogue: 0,0:03:23.71,0:03:26.41,Default,,0000,0000,0000,,already selected as TM GB I'll give it a
Dialogue: 0,0:03:26.41,0:03:36.15,Default,,0000,0000,0000,,name let's say total salary okay so now
Dialogue: 0,0:03:36.15,0:03:39.22,Default,,0000,0000,0000,,whether a macro is evil waste or not
Dialogue: 0,0:03:39.22,0:03:41.20,Default,,0000,0000,0000,,determined by this check box if you
Dialogue: 0,0:03:41.20,0:03:42.79,Default,,0000,0000,0000,,check this one it will be well waste
Dialogue: 0,0:03:42.79,0:03:45.49,Default,,0000,0000,0000,,macro if you don't just check this one
Dialogue: 0,0:03:45.49,0:03:48.22,Default,,0000,0000,0000,,it will be a non evil West macro so the
Dialogue: 0,0:03:48.22,0:03:49.66,Default,,0000,0000,0000,,first we will discuss about non evil
Dialogue: 0,0:03:49.66,0:03:51.73,Default,,0000,0000,0000,,missed macro so what I am trying to say
Dialogue: 0,0:03:51.73,0:03:55.18,Default,,0000,0000,0000,,is when you what I said is whenever we
Dialogue: 0,0:03:55.18,0:03:57.46,Default,,0000,0000,0000,,are creating a non evil West micro we
Dialogue: 0,0:03:57.46,0:03:59.11,Default,,0000,0000,0000,,can directly give a search string over
Dialogue: 0,0:03:59.11,0:04:01.27,Default,,0000,0000,0000,,there so my search team will be
Dialogue: 0,0:04:01.27,0:04:03.16,Default,,0000,0000,0000,,something like this I will be creating a
Dialogue: 0,0:04:03.16,0:04:05.89,Default,,0000,0000,0000,,new field called total salary so that's
Dialogue: 0,0:04:05.89,0:04:13.51,Default,,0000,0000,0000,,why that evil total salary equals to now
Dialogue: 0,0:04:13.51,0:04:17.38,Default,,0000,0000,0000,,I will be passing this to my basic
Dialogue: 0,0:04:17.38,0:04:19.87,Default,,0000,0000,0000,,salary and variable percent to this
Dialogue: 0,0:04:19.87,0:04:22.72,Default,,0000,0000,0000,,macro right row do that what I will do
Dialogue: 0,0:04:22.72,0:04:26.08,Default,,0000,0000,0000,,I'll create a argument of this macro
Dialogue: 0,0:04:26.08,0:04:28.30,Default,,0000,0000,0000,,in basic salary so in the argument
Dialogue: 0,0:04:28.30,0:04:32.55,Default,,0000,0000,0000,,section you will be giving control see
Dialogue: 0,0:04:32.55,0:04:35.71,Default,,0000,0000,0000,,these two things basic salary and
Dialogue: 0,0:04:35.71,0:04:40.36,Default,,0000,0000,0000,,variable percent as two arguments as the
Dialogue: 0,0:04:40.36,0:04:42.79,Default,,0000,0000,0000,,macro has two arguments it is mandatory
Dialogue: 0,0:04:42.79,0:04:46.78,Default,,0000,0000,0000,,that in this name section you give how
Dialogue: 0,0:04:46.78,0:04:48.82,Default,,0000,0000,0000,,many number of arguments you have in
Dialogue: 0,0:04:48.82,0:04:50.83,Default,,0000,0000,0000,,your macro if it is one you have to give
Dialogue: 0,0:04:50.83,0:04:55.63,Default,,0000,0000,0000,,one here okay now the formula is my
Dialogue: 0,0:04:55.63,0:04:59.14,Default,,0000,0000,0000,,basic salary now this basic salary is my
Dialogue: 0,0:04:59.14,0:05:03.01,Default,,0000,0000,0000,,input variable right so to access input
Dialogue: 0,0:05:03.01,0:05:04.78,Default,,0000,0000,0000,,variable you access like this just like
Dialogue: 0,0:05:04.78,0:05:11.77,Default,,0000,0000,0000,,it token okay basic salary plus my basic
Dialogue: 0,0:05:11.77,0:05:21.16,Default,,0000,0000,0000,,salary into that variable percent again
Dialogue: 0,0:05:21.16,0:05:26.32,Default,,0000,0000,0000,,as input I am accessing right then
Dialogue: 0,0:05:26.32,0:05:29.85,Default,,0000,0000,0000,,divide it by 100 so this will be minus
Dialogue: 0,0:05:29.85,0:05:33.76,Default,,0000,0000,0000,,macro body now there is a two options
Dialogue: 0,0:05:33.76,0:05:35.23,Default,,0000,0000,0000,,for validation expression interrogation
Dialogue: 0,0:05:35.23,0:05:36.58,Default,,0000,0000,0000,,error message I will show you in the
Dialogue: 0,0:05:36.58,0:05:42.40,Default,,0000,0000,0000,,next macro see if I save it okay
Dialogue: 0,0:05:42.40,0:05:44.91,Default,,0000,0000,0000,,so if you see the macro has been created
Dialogue: 0,0:05:44.91,0:05:49.51,Default,,0000,0000,0000,,now if I call this macro over here so to
Dialogue: 0,0:05:49.51,0:05:51.52,Default,,0000,0000,0000,,call a macro this is how you call there
Dialogue: 0,0:05:51.52,0:05:54.40,Default,,0000,0000,0000,,is a tick mark if you see okay from your
Dialogue: 0,0:05:54.40,0:06:01.06,Default,,0000,0000,0000,,keyboard then the macro name total
Dialogue: 0,0:06:01.06,0:06:04.69,Default,,0000,0000,0000,,salary and it has two arguments right my
Dialogue: 0,0:06:04.69,0:06:08.70,Default,,0000,0000,0000,,basic salary and my variable percent
Dialogue: 0,0:06:08.70,0:06:13.15,Default,,0000,0000,0000,,then tick end now this basic salary is
Dialogue: 0,0:06:13.15,0:06:15.13,Default,,0000,0000,0000,,corresponds to this basic salary and
Dialogue: 0,0:06:15.13,0:06:16.72,Default,,0000,0000,0000,,variable person corresponds to this
Dialogue: 0,0:06:16.72,0:06:18.07,Default,,0000,0000,0000,,variable person failed
Dialogue: 0,0:06:18.07,0:06:21.28,Default,,0000,0000,0000,,now when you define the macro I have
Dialogue: 0,0:06:21.28,0:06:23.05,Default,,0000,0000,0000,,given the same name as macro input you
Dialogue: 0,0:06:23.05,0:06:26.08,Default,,0000,0000,0000,,can give any any input variable name
Dialogue: 0,0:06:26.08,0:06:28.00,Default,,0000,0000,0000,,over here the same name you have to use
Dialogue: 0,0:06:28.00,0:06:30.58,Default,,0000,0000,0000,,over here as well but when you pass a
Dialogue: 0,0:06:30.58,0:06:33.76,Default,,0000,0000,0000,,macro pass this visix ready and variable
Dialogue: 0,0:06:33.76,0:06:35.86,Default,,0000,0000,0000,,person to this macro you'll be giving
Dialogue: 0,0:06:35.86,0:06:37.45,Default,,0000,0000,0000,,this field name only
Dialogue: 0,0:06:37.45,0:06:40.27,Default,,0000,0000,0000,,so let us run it and see what's going on
Dialogue: 0,0:06:40.27,0:06:43.89,Default,,0000,0000,0000,,if you see it has created a total salary
Dialogue: 0,0:06:43.89,0:06:47.65,Default,,0000,0000,0000,,failed with this formal output 4000 plus
Dialogue: 0,0:06:47.65,0:06:51.82,Default,,0000,0000,0000,,4000 into 15% is 4,600 right so it is
Dialogue: 0,0:06:51.82,0:06:54.64,Default,,0000,0000,0000,,basically same as the run time what is
Dialogue: 0,0:06:54.64,0:06:58.12,Default,,0000,0000,0000,,happening is something like this so if I
Dialogue: 0,0:06:58.12,0:07:00.10,Default,,0000,0000,0000,,instead of total salary if I just gave
Dialogue: 0,0:07:00.10,0:07:04.30,Default,,0000,0000,0000,,this one and instead of this token
Dialogue: 0,0:07:04.30,0:07:07.96,Default,,0000,0000,0000,,variable I just give my flake name here
Dialogue: 0,0:07:07.96,0:07:14.49,Default,,0000,0000,0000,,the output will be same variable percent
Dialogue: 0,0:07:14.49,0:07:18.52,Default,,0000,0000,0000,,the output will be same so this is how
Dialogue: 0,0:07:18.52,0:07:21.49,Default,,0000,0000,0000,,what is happening as well so run time
Dialogue: 0,0:07:21.49,0:07:25.06,Default,,0000,0000,0000,,Splunk is replacing this macro body with
Dialogue: 0,0:07:25.06,0:07:28.03,Default,,0000,0000,0000,,this variable inputs and then it is
Dialogue: 0,0:07:28.03,0:07:29.71,Default,,0000,0000,0000,,running the query so ultimately this
Dialogue: 0,0:07:29.71,0:07:32.74,Default,,0000,0000,0000,,squad is getting run okay so but the
Dialogue: 0,0:07:32.74,0:07:34.96,Default,,0000,0000,0000,,thing is this this code if you put it in
Dialogue: 0,0:07:34.96,0:07:36.91,Default,,0000,0000,0000,,a macro you can call that macro anybody
Dialogue: 0,0:07:36.91,0:07:39.13,Default,,0000,0000,0000,,new such so that means that this code
Dialogue: 0,0:07:39.13,0:07:42.49,Default,,0000,0000,0000,,portions will be reusable now okay now
Dialogue: 0,0:07:42.49,0:07:46.15,Default,,0000,0000,0000,,let's see an example where we can use
Dialogue: 0,0:07:46.15,0:07:47.68,Default,,0000,0000,0000,,this validation expression and
Dialogue: 0,0:07:47.68,0:07:49.27,Default,,0000,0000,0000,,validation error message now a
Dialogue: 0,0:07:49.27,0:07:51.70,Default,,0000,0000,0000,,validation expression is used when you
Dialogue: 0,0:07:51.70,0:07:54.82,Default,,0000,0000,0000,,want to do some kind of validation on
Dialogue: 0,0:07:54.82,0:08:00.28,Default,,0000,0000,0000,,your macro inputs okay so and validation
Dialogue: 0,0:08:00.28,0:08:02.83,Default,,0000,0000,0000,,error message means when this input is
Dialogue: 0,0:08:02.83,0:08:04.75,Default,,0000,0000,0000,,getting or this validation is getting
Dialogue: 0,0:08:04.75,0:08:06.43,Default,,0000,0000,0000,,filled this error message will be
Dialogue: 0,0:08:06.43,0:08:09.46,Default,,0000,0000,0000,,displayed over there so to do that what
Dialogue: 0,0:08:09.46,0:08:14.64,Default,,0000,0000,0000,,I will do is I'll create another macro
Dialogue: 0,0:08:14.64,0:08:20.11,Default,,0000,0000,0000,,okay so now let's say we have basic
Dialogue: 0,0:08:20.11,0:08:22.57,Default,,0000,0000,0000,,salary and variable percent right let's
Dialogue: 0,0:08:22.57,0:08:24.79,Default,,0000,0000,0000,,say we want to calculate a bonus
Dialogue: 0,0:08:24.79,0:08:27.67,Default,,0000,0000,0000,,percentage with this formula called
Dialogue: 0,0:08:27.67,0:08:32.35,Default,,0000,0000,0000,,variable percent variable percent plus
Dialogue: 0,0:08:32.35,0:08:35.62,Default,,0000,0000,0000,,any any of the person any number let's
Dialogue: 0,0:08:35.62,0:08:37.93,Default,,0000,0000,0000,,say seven percent or eight in a number
Dialogue: 0,0:08:37.93,0:08:40.54,Default,,0000,0000,0000,,I'll provide inputs it will give me it
Dialogue: 0,0:08:40.54,0:08:43.06,Default,,0000,0000,0000,,will add those two percentage value and
Dialogue: 0,0:08:43.06,0:08:45.61,Default,,0000,0000,0000,,give me the bonus percent okay so to do
Dialogue: 0,0:08:45.61,0:08:48.28,Default,,0000,0000,0000,,that I will just create that similar
Dialogue: 0,0:08:48.28,0:08:52.11,Default,,0000,0000,0000,,macro name bonus
Dialogue: 0,0:08:52.11,0:08:56.68,Default,,0000,0000,0000,,okay so the formula will be again it
Dialogue: 0,0:08:56.68,0:09:06.03,Default,,0000,0000,0000,,will be non evil based okay eval bonus
Dialogue: 0,0:09:07.86,0:09:13.84,Default,,0000,0000,0000,,equals two so my variable percent right
Dialogue: 0,0:09:13.84,0:09:16.27,Default,,0000,0000,0000,,I have to provide as a input so I'll
Dialogue: 0,0:09:16.27,0:09:18.79,Default,,0000,0000,0000,,giving input so let's say this time I
Dialogue: 0,0:09:18.79,0:09:21.61,Default,,0000,0000,0000,,will rename this to something maybe so
Dialogue: 0,0:09:21.61,0:09:27.81,Default,,0000,0000,0000,,I'll say dollar VP dollar then plus
Dialogue: 0,0:09:27.81,0:09:30.58,Default,,0000,0000,0000,,another input I will be giving let's say
Dialogue: 0,0:09:30.58,0:09:36.54,Default,,0000,0000,0000,,bonus input okay so this bonus I will be
Dialogue: 0,0:09:36.54,0:09:42.19,Default,,0000,0000,0000,,adding here okay Nonna's so we have two
Dialogue: 0,0:09:42.19,0:09:44.08,Default,,0000,0000,0000,,inputs that means we have to give two
Dialogue: 0,0:09:44.08,0:09:47.44,Default,,0000,0000,0000,,over here now I'll add an expression now
Dialogue: 0,0:09:47.44,0:09:50.26,Default,,0000,0000,0000,,I always want this bonus to be in number
Dialogue: 0,0:09:50.26,0:09:53.59,Default,,0000,0000,0000,,okay do that i'll so this validation
Dialogue: 0,0:09:53.59,0:09:55.69,Default,,0000,0000,0000,,expression has to be a boolean
Dialogue: 0,0:09:55.69,0:09:59.08,Default,,0000,0000,0000,,expression or eval okay so if you saw my
Dialogue: 0,0:09:59.08,0:10:01.21,Default,,0000,0000,0000,,previous video we we discussed about
Dialogue: 0,0:10:01.21,0:10:04.39,Default,,0000,0000,0000,,various evil expressions right and some
Dialogue: 0,0:10:04.39,0:10:06.16,Default,,0000,0000,0000,,of the expressions returns bully and the
Dialogue: 0,0:10:06.16,0:10:08.80,Default,,0000,0000,0000,,strict like operator or in operator or
Dialogue: 0,0:10:08.80,0:10:11.77,Default,,0000,0000,0000,,easy num operator which basically checks
Dialogue: 0,0:10:11.77,0:10:15.22,Default,,0000,0000,0000,,whether a particular input is number or
Dialogue: 0,0:10:15.22,0:10:17.23,Default,,0000,0000,0000,,not so you will be using is numb over
Dialogue: 0,0:10:17.23,0:10:20.53,Default,,0000,0000,0000,,here on this bonus that means I am
Dialogue: 0,0:10:20.53,0:10:23.29,Default,,0000,0000,0000,,checking whether whatever I am providing
Dialogue: 0,0:10:23.29,0:10:25.38,Default,,0000,0000,0000,,as the input to this bonus variable
Dialogue: 0,0:10:25.38,0:10:28.63,Default,,0000,0000,0000,,parameter whether it is number or not if
Dialogue: 0,0:10:28.63,0:10:32.35,Default,,0000,0000,0000,,it is not number will I will give this
Dialogue: 0,0:10:32.35,0:10:36.67,Default,,0000,0000,0000,,in this output error message bonus must
Dialogue: 0,0:10:36.67,0:10:41.49,Default,,0000,0000,0000,,be and number okay
Dialogue: 0,0:10:41.49,0:10:50.11,Default,,0000,0000,0000,,so let's save this macro okay now I will
Dialogue: 0,0:10:50.11,0:10:56.95,Default,,0000,0000,0000,,call this macro here let it be my total
Dialogue: 0,0:10:56.95,0:11:01.78,Default,,0000,0000,0000,,salary macro called as is if I just do
Dialogue: 0,0:11:01.78,0:11:03.53,Default,,0000,0000,0000,,control see
Dialogue: 0,0:11:03.53,0:11:06.53,Default,,0000,0000,0000,,okay here I'm calling my total salary so
Dialogue: 0,0:11:06.53,0:11:08.93,Default,,0000,0000,0000,,to stick the output now after that I'll
Dialogue: 0,0:11:08.93,0:11:14.93,Default,,0000,0000,0000,,be calling the bonus macro it's a
Dialogue: 0,0:11:14.93,0:11:17.96,Default,,0000,0000,0000,,similar way tick macro named micro
Dialogue: 0,0:11:17.96,0:11:19.76,Default,,0000,0000,0000,,inputs one of the inputs will be my
Dialogue: 0,0:11:19.76,0:11:22.82,Default,,0000,0000,0000,,variable percent and another another
Dialogue: 0,0:11:22.82,0:11:25.79,Default,,0000,0000,0000,,output may be let's say 8 percent I want
Dialogue: 0,0:11:25.79,0:11:28.40,Default,,0000,0000,0000,,to add with the variable percent so what
Dialogue: 0,0:11:28.40,0:11:30.77,Default,,0000,0000,0000,,will be output in this case it should
Dialogue: 0,0:11:30.77,0:11:33.56,Default,,0000,0000,0000,,create a new field called bonus with 15
Dialogue: 0,0:11:33.56,0:11:35.78,Default,,0000,0000,0000,,plus 8 20 plus 8 something like this
Dialogue: 0,0:11:35.78,0:11:39.40,Default,,0000,0000,0000,,okay if you see you can create you can
Dialogue: 0,0:11:39.40,0:11:41.87,Default,,0000,0000,0000,,access different different macros in
Dialogue: 0,0:11:41.87,0:11:48.14,Default,,0000,0000,0000,,your whole search okay now let's say I
Dialogue: 0,0:11:48.14,0:11:52.57,Default,,0000,0000,0000,,have provided a string here it says test
Dialogue: 0,0:11:52.57,0:11:55.28,Default,,0000,0000,0000,,ok what is happening so if you provide
Dialogue: 0,0:11:55.28,0:11:57.77,Default,,0000,0000,0000,,this thing here that validation is
Dialogue: 0,0:11:57.77,0:11:59.66,Default,,0000,0000,0000,,getting failed we have added over here
Dialogue: 0,0:11:59.66,0:12:02.45,Default,,0000,0000,0000,,is numb so that set is giving you this
Dialogue: 0,0:12:02.45,0:12:05.51,Default,,0000,0000,0000,,error bonus must be a number so this is
Dialogue: 0,0:12:05.51,0:12:10.25,Default,,0000,0000,0000,,how macro input validation works ok let
Dialogue: 0,0:12:10.25,0:12:15.28,Default,,0000,0000,0000,,us continue now we will discuss about
Dialogue: 0,0:12:15.28,0:12:18.83,Default,,0000,0000,0000,,how to create an eval macro so to do
Dialogue: 0,0:12:18.83,0:12:22.52,Default,,0000,0000,0000,,that what we'll do is first let me show
Dialogue: 0,0:12:22.52,0:12:24.92,Default,,0000,0000,0000,,you two things if you remember from my
Dialogue: 0,0:12:24.92,0:12:28.22,Default,,0000,0000,0000,,previous video we have created a command
Dialogue: 0,0:12:28.22,0:12:31.94,Default,,0000,0000,0000,,called gate churners right and that
Dialogue: 0,0:12:31.94,0:12:33.80,Default,,0000,0000,0000,,common takes an input with the journal
Dialogue: 0,0:12:33.80,0:12:36.41,Default,,0000,0000,0000,,ID and if we are not giving any general
Dialogue: 0,0:12:36.41,0:12:38.78,Default,,0000,0000,0000,,idea giving star it will give you all
Dialogue: 0,0:12:38.78,0:12:41.78,Default,,0000,0000,0000,,the journal titles right and also we
Dialogue: 0,0:12:41.78,0:12:47.63,Default,,0000,0000,0000,,have a we have created a our we have
Dialogue: 0,0:12:47.63,0:12:50.75,Default,,0000,0000,0000,,index our data into this main index
Dialogue: 0,0:12:50.75,0:12:52.13,Default,,0000,0000,0000,,right so you have another data set
Dialogue: 0,0:12:52.13,0:12:54.20,Default,,0000,0000,0000,,called main where we have we're having
Dialogue: 0,0:12:54.20,0:12:56.27,Default,,0000,0000,0000,,this salary and this information just
Dialogue: 0,0:12:56.27,0:12:58.52,Default,,0000,0000,0000,,now you are working with a data set so
Dialogue: 0,0:12:58.52,0:13:01.00,Default,,0000,0000,0000,,suppose there is a requirement that
Dialogue: 0,0:13:01.00,0:13:04.73,Default,,0000,0000,0000,,based on certain condition either I need
Dialogue: 0,0:13:04.73,0:13:09.11,Default,,0000,0000,0000,,to go with this data set or I need to go
Dialogue: 0,0:13:09.11,0:13:11.33,Default,,0000,0000,0000,,with this data set in this type of
Dialogue: 0,0:13:11.33,0:13:13.73,Default,,0000,0000,0000,,scenario where dynamically you have to
Dialogue: 0,0:13:13.73,0:13:15.98,Default,,0000,0000,0000,,determine which data set to work on or
Dialogue: 0,0:13:15.98,0:13:17.33,Default,,0000,0000,0000,,dynamically
Dialogue: 0,0:13:17.33,0:13:20.60,Default,,0000,0000,0000,,in which search string to which search
Dialogue: 0,0:13:20.60,0:13:22.55,Default,,0000,0000,0000,,things were written that means to
Dialogue: 0,0:13:22.55,0:13:25.10,Default,,0000,0000,0000,,assistant to work with eval macros are
Dialogue: 0,0:13:25.10,0:13:28.49,Default,,0000,0000,0000,,coming into picture okay so because the
Dialogue: 0,0:13:28.49,0:13:31.13,Default,,0000,0000,0000,,main concept behind evil macro is it has
Dialogue: 0,0:13:31.13,0:13:34.28,Default,,0000,0000,0000,,to return a string so in that case how
Dialogue: 0,0:13:34.28,0:13:36.41,Default,,0000,0000,0000,,we will create is like this let's say
Dialogue: 0,0:13:36.41,0:13:39.53,Default,,0000,0000,0000,,new search macro I'll give a name call
Dialogue: 0,0:13:39.53,0:13:46.58,Default,,0000,0000,0000,,gate channel or main index okay just
Dialogue: 0,0:13:46.58,0:13:48.68,Default,,0000,0000,0000,,like the name just to show you the use
Dialogue: 0,0:13:48.68,0:13:51.98,Default,,0000,0000,0000,,case of it so here what I will write I
Dialogue: 0,0:13:51.98,0:13:53.90,Default,,0000,0000,0000,,will write it if or case statement
Dialogue: 0,0:13:53.90,0:13:55.49,Default,,0000,0000,0000,,really mostly we light a key for case
Dialogue: 0,0:13:55.49,0:13:59.33,Default,,0000,0000,0000,,statement for eval based macro so case
Dialogue: 0,0:13:59.33,0:14:02.09,Default,,0000,0000,0000,,so that we can have different different
Dialogue: 0,0:14:02.09,0:14:03.47,Default,,0000,0000,0000,,condition and based on the condition we
Dialogue: 0,0:14:03.47,0:14:05.24,Default,,0000,0000,0000,,will be returning the search string but
Dialogue: 0,0:14:05.24,0:14:07.22,Default,,0000,0000,0000,,ultimately if you see we are in the
Dialogue: 0,0:14:07.22,0:14:09.02,Default,,0000,0000,0000,,start sitting only at the end of the day
Dialogue: 0,0:14:09.02,0:14:11.03,Default,,0000,0000,0000,,so that Splunk will replace that macro
Dialogue: 0,0:14:11.03,0:14:13.40,Default,,0000,0000,0000,,with that search string so i'm saying i
Dialogue: 0,0:14:13.40,0:14:17.65,Default,,0000,0000,0000,,will provide argument here let's say
Dialogue: 0,0:14:17.65,0:14:21.17,Default,,0000,0000,0000,,same same argument name let's say so
Dialogue: 0,0:14:21.17,0:14:23.36,Default,,0000,0000,0000,,either i will provide gate channel or i
Dialogue: 0,0:14:23.36,0:14:25.88,Default,,0000,0000,0000,,will provide main as my or argument
Dialogue: 0,0:14:25.88,0:14:27.98,Default,,0000,0000,0000,,value okay i'll show you how how i
Dialogue: 0,0:14:27.98,0:14:31.52,Default,,0000,0000,0000,,provide that one case i am saying my
Dialogue: 0,0:14:31.52,0:14:37.67,Default,,0000,0000,0000,,input taller this one dollar is equals
Dialogue: 0,0:14:37.67,0:14:42.86,Default,,0000,0000,0000,,to let us say gate channel okay as it is
Dialogue: 0,0:14:42.86,0:14:46.64,Default,,0000,0000,0000,,within quotes remember that if this one
Dialogue: 0,0:14:46.64,0:14:49.70,Default,,0000,0000,0000,,has to be quotes as well or when you are
Dialogue: 0,0:14:49.70,0:14:51.56,Default,,0000,0000,0000,,calling you have to call with this with
Dialogue: 0,0:14:51.56,0:14:53.84,Default,,0000,0000,0000,,course i prefer to be like this only so
Dialogue: 0,0:14:53.84,0:14:55.61,Default,,0000,0000,0000,,that everything is in your inside your
Dialogue: 0,0:14:55.61,0:14:58.70,Default,,0000,0000,0000,,macro only in that case the string I
Dialogue: 0,0:14:58.70,0:15:04.100,Default,,0000,0000,0000,,will return is this kind get Jenna star
Dialogue: 0,0:15:04.100,0:15:07.13,Default,,0000,0000,0000,,now you have to be very careful over
Dialogue: 0,0:15:07.13,0:15:10.46,Default,,0000,0000,0000,,here when you dil Dil with a generating
Dialogue: 0,0:15:10.46,0:15:11.87,Default,,0000,0000,0000,,command if you seek it generates a
Dialogue: 0,0:15:11.87,0:15:13.61,Default,,0000,0000,0000,,generating comment right thats why this
Dialogue: 0,0:15:13.61,0:15:15.02,Default,,0000,0000,0000,,has to be the first command in your
Dialogue: 0,0:15:15.02,0:15:19.87,Default,,0000,0000,0000,,search string now for generating comment
Dialogue: 0,0:15:19.87,0:15:22.55,Default,,0000,0000,0000,,when you run it if you see there is a
Dialogue: 0,0:15:22.55,0:15:25.22,Default,,0000,0000,0000,,bar over here search bar right after
Dialogue: 0,0:15:25.22,0:15:27.05,Default,,0000,0000,0000,,that only if I run this command without
Dialogue: 0,0:15:27.05,0:15:29.81,Default,,0000,0000,0000,,this word nothing will come up
Dialogue: 0,0:15:29.81,0:15:32.15,Default,,0000,0000,0000,,it requires this bar but when you put
Dialogue: 0,0:15:32.15,0:15:35.48,Default,,0000,0000,0000,,this gate Jenner star this generating
Dialogue: 0,0:15:35.48,0:15:38.96,Default,,0000,0000,0000,,command inside a macro so you put it
Dialogue: 0,0:15:38.96,0:15:41.09,Default,,0000,0000,0000,,without the bar so that when you call
Dialogue: 0,0:15:41.09,0:15:43.94,Default,,0000,0000,0000,,the macro you will call with bar then
Dialogue: 0,0:15:43.94,0:15:45.32,Default,,0000,0000,0000,,macro name I will show you that one as
Dialogue: 0,0:15:45.32,0:15:47.66,Default,,0000,0000,0000,,well but that's why I am giving without
Dialogue: 0,0:15:47.66,0:15:50.54,Default,,0000,0000,0000,,the bar here this is this has to be very
Dialogue: 0,0:15:50.54,0:15:53.11,Default,,0000,0000,0000,,careful with the generating comments
Dialogue: 0,0:15:53.11,0:15:55.31,Default,,0000,0000,0000,,because if you put bar inside it will
Dialogue: 0,0:15:55.31,0:16:01.07,Default,,0000,0000,0000,,not work now when my input is main ok in
Dialogue: 0,0:16:01.07,0:16:04.58,Default,,0000,0000,0000,,that case I will return the string
Dialogue: 0,0:16:04.58,0:16:10.31,Default,,0000,0000,0000,,called search index equals two main here
Dialogue: 0,0:16:10.31,0:16:12.62,Default,,0000,0000,0000,,also another good thing is when you run
Dialogue: 0,0:16:12.62,0:16:14.54,Default,,0000,0000,0000,,index equals two main from your search
Dialogue: 0,0:16:14.54,0:16:16.67,Default,,0000,0000,0000,,prompt right you do not need to mention
Dialogue: 0,0:16:16.67,0:16:18.68,Default,,0000,0000,0000,,search then index equals two main
Dialogue: 0,0:16:18.68,0:16:21.83,Default,,0000,0000,0000,,because that is by default comes up but
Dialogue: 0,0:16:21.83,0:16:23.90,Default,,0000,0000,0000,,when you use it in a macro or somewhere
Dialogue: 0,0:16:23.90,0:16:24.23,Default,,0000,0000,0000,,else
Dialogue: 0,0:16:24.23,0:16:27.11,Default,,0000,0000,0000,,you have to put it like this search then
Dialogue: 0,0:16:27.11,0:16:31.16,Default,,0000,0000,0000,,index equals to me okay so this thing I
Dialogue: 0,0:16:31.16,0:16:33.35,Default,,0000,0000,0000,,will be returning says my macro has one
Dialogue: 0,0:16:33.35,0:16:37.07,Default,,0000,0000,0000,,input so I will be giving one here okay
Dialogue: 0,0:16:37.07,0:16:39.23,Default,,0000,0000,0000,,validation we are not doing anything now
Dialogue: 0,0:16:39.23,0:16:44.39,Default,,0000,0000,0000,,so let's save it okay this is our third
Dialogue: 0,0:16:44.39,0:16:48.77,Default,,0000,0000,0000,,macro so get general or main see if I
Dialogue: 0,0:16:48.77,0:16:53.75,Default,,0000,0000,0000,,run this macro now okay so as I said it
Dialogue: 0,0:16:53.75,0:16:56.15,Default,,0000,0000,0000,,has a generating comment that's why I am
Dialogue: 0,0:16:56.15,0:16:59.96,Default,,0000,0000,0000,,giving a bar over here then my take and
Dialogue: 0,0:16:59.96,0:17:03.68,Default,,0000,0000,0000,,then my input let's say I will be giving
Dialogue: 0,0:17:03.68,0:17:09.53,Default,,0000,0000,0000,,input s get general I want to know I
Dialogue: 0,0:17:09.53,0:17:11.48,Default,,0000,0000,0000,,want to work with the data set to get
Dialogue: 0,0:17:11.48,0:17:21.22,Default,,0000,0000,0000,,channel okay so if let's see okay
Dialogue: 0,0:17:21.22,0:17:28.37,Default,,0000,0000,0000,,bracket this missing over here save now
Dialogue: 0,0:17:28.37,0:17:30.02,Default,,0000,0000,0000,,if you see if I run this macro again it
Dialogue: 0,0:17:30.02,0:17:31.64,Default,,0000,0000,0000,,is giving me same because sometimes it's
Dialogue: 0,0:17:31.64,0:17:34.52,Default,,0000,0000,0000,,not you don't take the refreshed value
Dialogue: 0,0:17:34.52,0:17:36.62,Default,,0000,0000,0000,,so what I will do in this case just copy
Dialogue: 0,0:17:36.62,0:17:41.69,Default,,0000,0000,0000,,this code close it Danny taking such
Dialogue: 0,0:17:41.69,0:17:43.34,Default,,0000,0000,0000,,Factory unknown search comma
Dialogue: 0,0:17:43.34,0:17:55.85,Default,,0000,0000,0000,,and case to see what's going on okay it
Dialogue: 0,0:17:55.85,0:17:58.28,Default,,0000,0000,0000,,has to be evil waste macro because it is
Dialogue: 0,0:17:58.28,0:18:01.19,Default,,0000,0000,0000,,running a string now right so let's say
Dialogue: 0,0:18:01.19,0:18:10.76,Default,,0000,0000,0000,,wait and let it is not okay now if you
Dialogue: 0,0:18:10.76,0:18:13.91,Default,,0000,0000,0000,,see if I run this gate general macro so
Dialogue: 0,0:18:13.91,0:18:15.41,Default,,0000,0000,0000,,it is giving me this data set where it
Dialogue: 0,0:18:15.41,0:18:17.23,Default,,0000,0000,0000,,is running that gate general Starr
Dialogue: 0,0:18:17.23,0:18:19.13,Default,,0000,0000,0000,,generating command and giving me this
Dialogue: 0,0:18:19.13,0:18:23.51,Default,,0000,0000,0000,,result if I say main in this case it is
Dialogue: 0,0:18:23.51,0:18:26.09,Default,,0000,0000,0000,,giving me this data set where I have
Dialogue: 0,0:18:26.09,0:18:29.75,Default,,0000,0000,0000,,index my data so this is how you can
Dialogue: 0,0:18:29.75,0:18:33.02,Default,,0000,0000,0000,,create a evil waste macro okay so now
Dialogue: 0,0:18:33.02,0:18:36.77,Default,,0000,0000,0000,,macro has a diff separate permissions as
Dialogue: 0,0:18:36.77,0:18:39.59,Default,,0000,0000,0000,,well if you see from this macro macro
Dialogue: 0,0:18:39.59,0:18:44.09,Default,,0000,0000,0000,,list page you can and you can set the
Dialogue: 0,0:18:44.09,0:18:46.43,Default,,0000,0000,0000,,permissions as well so currently I will
Dialogue: 0,0:18:46.43,0:18:48.05,Default,,0000,0000,0000,,show you I will set this permission as
Dialogue: 0,0:18:48.05,0:18:50.33,Default,,0000,0000,0000,,this upon't Li and read I will say
Dialogue: 0,0:18:50.33,0:18:52.94,Default,,0000,0000,0000,,everyone and right let's say admin let's
Dialogue: 0,0:18:52.94,0:18:57.38,Default,,0000,0000,0000,,do it for all the macros permission so
Dialogue: 0,0:18:57.38,0:18:58.52,Default,,0000,0000,0000,,you have to be very careful with the
Dialogue: 0,0:18:58.52,0:19:02.48,Default,,0000,0000,0000,,macro permissions as well otherwise any
Dialogue: 0,0:19:02.48,0:19:04.52,Default,,0000,0000,0000,,unprivileged user will not be able to
Dialogue: 0,0:19:04.52,0:19:07.10,Default,,0000,0000,0000,,run this macro and your dashboard will
Dialogue: 0,0:19:07.10,0:19:11.89,Default,,0000,0000,0000,,not show up anything so read/write okay
Dialogue: 0,0:19:11.89,0:19:14.33,Default,,0000,0000,0000,,now we have set the permissions of the
Dialogue: 0,0:19:14.33,0:19:17.12,Default,,0000,0000,0000,,macro as well now let's see what's going
Dialogue: 0,0:19:17.12,0:19:19.49,Default,,0000,0000,0000,,on at the background so I am in my
Dialogue: 0,0:19:19.49,0:19:24.02,Default,,0000,0000,0000,,Splunk home I will go to a TC apps tmdb
Dialogue: 0,0:19:24.02,0:19:26.99,Default,,0000,0000,0000,,F and I will go to my local folder if
Dialogue: 0,0:19:26.99,0:19:28.97,Default,,0000,0000,0000,,you see whenever you creates a macro
Dialogue: 0,0:19:28.97,0:19:31.22,Default,,0000,0000,0000,,it's creates a another Khan file called
Dialogue: 0,0:19:31.22,0:19:34.10,Default,,0000,0000,0000,,macro scones I will open this file and
Dialogue: 0,0:19:34.10,0:19:37.19,Default,,0000,0000,0000,,if you see all different macros we have
Dialogue: 0,0:19:37.19,0:19:39.08,Default,,0000,0000,0000,,created its gate separate separate
Dialogue: 0,0:19:39.08,0:19:43.04,Default,,0000,0000,0000,,stanza for that macro name and with all
Dialogue: 0,0:19:43.04,0:19:45.92,Default,,0000,0000,0000,,the input numbers right and args is the
Dialogue: 0,0:19:45.92,0:19:49.07,Default,,0000,0000,0000,,inputs of this macros wait for bonus if
Dialogue: 0,0:19:49.07,0:19:52.82,Default,,0000,0000,0000,,you see here for bonus my arguments are
Dialogue: 0,0:19:52.82,0:19:55.52,Default,,0000,0000,0000,,VPN bonus like two arguments those are
Dialogue: 0,0:19:55.52,0:19:56.84,Default,,0000,0000,0000,,showing up here this
Dialogue: 0,0:19:56.84,0:19:59.24,Default,,0000,0000,0000,,the macro definition this is the error
Dialogue: 0,0:19:59.24,0:20:02.03,Default,,0000,0000,0000,,message you set it for this macro this
Dialogue: 0,0:20:02.03,0:20:03.32,Default,,0000,0000,0000,,is the validation you have set it for
Dialogue: 0,0:20:03.32,0:20:06.47,Default,,0000,0000,0000,,this macro and this is evil is telling
Dialogue: 0,0:20:06.47,0:20:08.48,Default,,0000,0000,0000,,you whether this macro is well based or
Dialogue: 0,0:20:08.48,0:20:10.91,Default,,0000,0000,0000,,not as our last macro get general or
Dialogue: 0,0:20:10.91,0:20:13.79,Default,,0000,0000,0000,,main is evil ways that Troy is evil is
Dialogue: 0,0:20:13.79,0:20:16.13,Default,,0000,0000,0000,,one for rest of the - macros easy well
Dialogue: 0,0:20:16.13,0:20:21.08,Default,,0000,0000,0000,,is zero okay now you can you can call a
Dialogue: 0,0:20:21.08,0:20:23.78,Default,,0000,0000,0000,,macro another inside another macro so to
Dialogue: 0,0:20:23.78,0:20:26.69,Default,,0000,0000,0000,,do that let's do this exercise where we
Dialogue: 0,0:20:26.69,0:20:28.49,Default,,0000,0000,0000,,have created these totals energy right
Dialogue: 0,0:20:28.49,0:20:29.93,Default,,0000,0000,0000,,and also bonus
Dialogue: 0,0:20:29.93,0:20:31.94,Default,,0000,0000,0000,,so inside total Cirelli we will try to
Dialogue: 0,0:20:31.94,0:20:35.06,Default,,0000,0000,0000,,call this bonus one who do that I will
Dialogue: 0,0:20:35.06,0:20:37.55,Default,,0000,0000,0000,,do one thing I will clone this total
Dialogue: 0,0:20:37.55,0:20:40.31,Default,,0000,0000,0000,,celery macro no I like this let's let's
Dialogue: 0,0:20:40.31,0:20:43.87,Default,,0000,0000,0000,,get a new one only it's a total salary
Dialogue: 0,0:20:43.87,0:20:48.46,Default,,0000,0000,0000,,total salary
Dialogue: 0,0:20:49.78,0:20:50.99,Default,,0000,0000,0000,,yv2
Dialogue: 0,0:20:50.99,0:20:53.87,Default,,0000,0000,0000,,version - okay so what I will do it will
Dialogue: 0,0:20:53.87,0:20:57.20,Default,,0000,0000,0000,,not be well based macro let's say my
Dialogue: 0,0:20:57.20,0:21:01.85,Default,,0000,0000,0000,,previous will be there he well right so
Dialogue: 0,0:21:01.85,0:21:06.20,Default,,0000,0000,0000,,it has two arguments basic salary and
Dialogue: 0,0:21:06.20,0:21:11.15,Default,,0000,0000,0000,,variable percent right now I'll be
Dialogue: 0,0:21:11.15,0:21:14.42,Default,,0000,0000,0000,,adding this bonus as well so bonus
Dialogue: 0,0:21:14.42,0:21:16.28,Default,,0000,0000,0000,,requires another extra input called
Dialogue: 0,0:21:16.28,0:21:19.46,Default,,0000,0000,0000,,bonus right so I will be adding this as
Dialogue: 0,0:21:19.46,0:21:23.18,Default,,0000,0000,0000,,a extra input comma this so my total
Dialogue: 0,0:21:23.18,0:21:27.02,Default,,0000,0000,0000,,macro inputs will be three basic salary
Dialogue: 0,0:21:27.02,0:21:29.75,Default,,0000,0000,0000,,and variable pay will be he'll be used
Dialogue: 0,0:21:29.75,0:21:33.02,Default,,0000,0000,0000,,here and variable pay and bonus will be
Dialogue: 0,0:21:33.02,0:21:35.66,Default,,0000,0000,0000,,used in another evil statement which we
Dialogue: 0,0:21:35.66,0:21:37.73,Default,,0000,0000,0000,,have which will be a calling in this
Dialogue: 0,0:21:37.73,0:21:40.76,Default,,0000,0000,0000,,bonus macro right so in this case I will
Dialogue: 0,0:21:40.76,0:21:44.36,Default,,0000,0000,0000,,be calling this bonus macro inside so
Dialogue: 0,0:21:44.36,0:21:48.83,Default,,0000,0000,0000,,I'll say this one pipe then my bonus
Dialogue: 0,0:21:48.83,0:21:51.55,Default,,0000,0000,0000,,macro bonus macro takes two arguments
Dialogue: 0,0:21:51.55,0:21:54.83,Default,,0000,0000,0000,,one is variable percent and another is
Dialogue: 0,0:21:54.83,0:21:59.66,Default,,0000,0000,0000,,bonus so variable percent I'll pass and
Dialogue: 0,0:21:59.66,0:22:04.37,Default,,0000,0000,0000,,I'll pass this bonus as well so ideally
Dialogue: 0,0:22:04.37,0:22:06.74,Default,,0000,0000,0000,,the behavior should be same as we have
Dialogue: 0,0:22:06.74,0:22:10.53,Default,,0000,0000,0000,,seen before right so
Dialogue: 0,0:22:10.53,0:22:18.75,Default,,0000,0000,0000,,done tick okay so now let's save it okay
Dialogue: 0,0:22:18.75,0:22:21.69,Default,,0000,0000,0000,,so total sir I do so before before I do
Dialogue: 0,0:22:21.69,0:22:27.03,Default,,0000,0000,0000,,that so let us run our macro so I'll
Dialogue: 0,0:22:27.03,0:22:31.67,Default,,0000,0000,0000,,just copy paste that code portion here
Dialogue: 0,0:22:31.67,0:22:35.85,Default,,0000,0000,0000,,right so I'll just copy paste this code
Dialogue: 0,0:22:35.85,0:22:37.88,Default,,0000,0000,0000,,portion here
Dialogue: 0,0:22:37.88,0:22:41.19,Default,,0000,0000,0000,,it's a macro total salary nan okay I
Dialogue: 0,0:22:41.19,0:22:47.39,Default,,0000,0000,0000,,think total I am my macro is total 7
Dialogue: 0,0:22:54.26,0:23:00.00,Default,,0000,0000,0000,,this mismatch parenthesis okay okay so
Dialogue: 0,0:23:00.00,0:23:03.00,Default,,0000,0000,0000,,it has created this one in this new new
Dialogue: 0,0:23:03.00,0:23:06.33,Default,,0000,0000,0000,,field in the new search field what I
Dialogue: 0,0:23:06.33,0:23:09.51,Default,,0000,0000,0000,,will do is on after this one
Dialogue: 0,0:23:09.51,0:23:13.02,Default,,0000,0000,0000,,I will be calling my total salary
Dialogue: 0,0:23:13.02,0:23:16.02,Default,,0000,0000,0000,,version 2 macro okay what it is doing
Dialogue: 0,0:23:16.02,0:23:18.48,Default,,0000,0000,0000,,the work of both of these 2 bonus and
Dialogue: 0,0:23:18.48,0:23:20.88,Default,,0000,0000,0000,,total salary right so total salary
Dialogue: 0,0:23:20.88,0:23:26.64,Default,,0000,0000,0000,,version - okay so my tick version 2
Dialogue: 0,0:23:26.64,0:23:29.58,Default,,0000,0000,0000,,version 2 requires three arguments one
Dialogue: 0,0:23:29.58,0:23:32.22,Default,,0000,0000,0000,,is my basic salary variable percent and
Dialogue: 0,0:23:32.22,0:23:35.04,Default,,0000,0000,0000,,the similar person value I will gives 8
Dialogue: 0,0:23:35.04,0:23:36.93,Default,,0000,0000,0000,,so that we can at least compare what's
Dialogue: 0,0:23:36.93,0:23:41.34,Default,,0000,0000,0000,,the outputs so if I run this one see if
Dialogue: 0,0:23:41.34,0:23:42.72,Default,,0000,0000,0000,,it is it is working in the same way
Dialogue: 0,0:23:42.72,0:23:45.15,Default,,0000,0000,0000,,where it is getting this bonus field and
Dialogue: 0,0:23:45.15,0:23:46.86,Default,,0000,0000,0000,,total salary and if you see the output
Dialogue: 0,0:23:46.86,0:23:49.55,Default,,0000,0000,0000,,is same as well
Dialogue: 0,0:23:49.55,0:23:53.70,Default,,0000,0000,0000,,15:22 we have given seven here okay
Dialogue: 0,0:23:53.70,0:23:57.60,Default,,0000,0000,0000,,let's let's run it with seven only see
Dialogue: 0,0:23:57.60,0:23:59.16,Default,,0000,0000,0000,,if you see fifteen twenty two twenty two
Dialogue: 0,0:23:59.16,0:24:01.77,Default,,0000,0000,0000,,twenty seventeen ten seventy like this
Dialogue: 0,0:24:01.77,0:24:05.61,Default,,0000,0000,0000,,okay so this is how you can call a macro
Dialogue: 0,0:24:05.61,0:24:08.37,Default,,0000,0000,0000,,inside another macro as well so if you
Dialogue: 0,0:24:08.37,0:24:11.94,Default,,0000,0000,0000,,see here by by by by this structure you
Dialogue: 0,0:24:11.94,0:24:14.85,Default,,0000,0000,0000,,can achieve a very complex structure as
Dialogue: 0,0:24:14.85,0:24:18.18,Default,,0000,0000,0000,,well and complex structure which which
Dialogue: 0,0:24:18.18,0:24:20.25,Default,,0000,0000,0000,,is basically a useable component in
Dialogue: 0,0:24:20.25,0:24:24.21,Default,,0000,0000,0000,,Splunk search query okay so this is how
Dialogue: 0,0:24:24.21,0:24:26.52,Default,,0000,0000,0000,,you need to know basically to deal with
Dialogue: 0,0:24:26.52,0:24:29.79,Default,,0000,0000,0000,,macros and macros are very useful in
Dialogue: 0,0:24:29.79,0:24:32.76,Default,,0000,0000,0000,,Splunk because not only it it it gives
Dialogue: 0,0:24:32.76,0:24:36.24,Default,,0000,0000,0000,,you the modularity approach but also
Dialogue: 0,0:24:36.24,0:24:38.82,Default,,0000,0000,0000,,it's it's is give you the very shorter
Dialogue: 0,0:24:38.82,0:24:41.07,Default,,0000,0000,0000,,search string and very readable course
Dialogue: 0,0:24:41.07,0:24:45.35,Default,,0000,0000,0000,,as well ok see you in next video