[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:00.03,0:00:02.94,Default,,0000,0000,0000,,Okay. Today, we'll discuss Splunk
Dialogue: 0,0:00:02.94,0:00:06.24,Default,,0000,0000,0000,,macros. Okay. So, Splunk macros--you can
Dialogue: 0,0:00:06.24,0:00:09.09,Default,,0000,0000,0000,,think of them as reusable components in
Dialogue: 0,0:00:09.09,0:00:12.96,Default,,0000,0000,0000,,your Splunk search where, suppose a
Dialogue: 0,0:00:12.96,0:00:15.87,Default,,0000,0000,0000,,particular search portion is
Dialogue: 0,0:00:15.87,0:00:18.93,Default,,0000,0000,0000,,if you used many times, then you
Dialogue: 0,0:00:18.93,0:00:20.46,Default,,0000,0000,0000,,can put it in a macro so that you can
Dialogue: 0,0:00:20.46,0:00:23.58,Default,,0000,0000,0000,,call that macro, and the macro will be
Dialogue: 0,0:00:23.58,0:00:26.31,Default,,0000,0000,0000,,replaced at runtime with that search string.
Dialogue: 0,0:00:26.31,0:00:28.92,Default,,0000,0000,0000,,Okay? So, macros are very, very useful when,
Dialogue: 0,0:00:28.92,0:00:31.89,Default,,0000,0000,0000,,suppose you have many dashboards in your
Dialogue: 0,0:00:31.89,0:00:34.59,Default,,0000,0000,0000,,application. And in all these dashboards, you
Dialogue: 0,0:00:34.59,0:00:38.67,Default,,0000,0000,0000,,have some search which is running in all
Dialogue: 0,0:00:38.67,0:00:41.61,Default,,0000,0000,0000,,the dashboards. Right? So, in this case, you
Dialogue: 0,0:00:41.61,0:00:43.41,Default,,0000,0000,0000,,can implement that search portion in a
Dialogue: 0,0:00:43.41,0:00:45.68,Default,,0000,0000,0000,,macro so that you can just call that macro
Dialogue: 0,0:00:45.68,0:00:47.85,Default,,0000,0000,0000,,instead of using the whole search string in
Dialogue: 0,0:00:47.85,0:00:50.37,Default,,0000,0000,0000,,your dashboards. So, in the future, if you
Dialogue: 0,0:00:50.37,0:00:52.44,Default,,0000,0000,0000,,want to make any changes in that search
Dialogue: 0,0:00:52.44,0:00:55.14,Default,,0000,0000,0000,,logic, we'll just change it in
Dialogue: 0,0:00:55.14,0:00:58.53,Default,,0000,0000,0000,,one place--in that macro body. Okay?
Dialogue: 0,0:00:58.53,0:01:01.35,Default,,0000,0000,0000,,So, by implementing a macro, basically, we
Dialogue: 0,0:01:01.35,0:01:04.17,Default,,0000,0000,0000,,are achieving two things. One is the
Dialogue: 0,0:01:04.17,0:01:06.93,Default,,0000,0000,0000,,modularity of your code--easy
Dialogue: 0,0:01:06.93,0:01:09.63,Default,,0000,0000,0000,,maintenance of your code--as well as
Dialogue: 0,0:01:09.63,0:01:11.25,Default,,0000,0000,0000,,your search string will be much
Dialogue: 0,0:01:11.25,0:01:15.72,Default,,0000,0000,0000,,smaller. Okay? So, there are
Dialogue: 0,0:01:15.72,0:01:18.69,Default,,0000,0000,0000,,two different types of macros we
Dialogue: 0,0:01:18.69,0:01:20.58,Default,,0000,0000,0000,,generally deal with. One is an eval-based
Dialogue: 0,0:01:20.58,0:01:23.19,Default,,0000,0000,0000,,macro, and another is a non-eval-based
Dialogue: 0,0:01:23.19,0:01:26.40,Default,,0000,0000,0000,,macro. So, before we discuss those things,
Dialogue: 0,0:01:26.40,0:01:29.79,Default,,0000,0000,0000,,let me show you the data I have here.
Dialogue: 0,0:01:29.79,0:01:32.91,Default,,0000,0000,0000,,So, I have some people's names, their
Dialogue: 0,0:01:32.91,0:01:36.27,Default,,0000,0000,0000,,basic salary, and variable percent. So,
Dialogue: 0,0:01:36.27,0:01:40.67,Default,,0000,0000,0000,,I'll show you how to create an eval-based macro,
Dialogue: 0,0:01:40.67,0:01:42.42,Default,,0000,0000,0000,,how to create a non-eval-based
Dialogue: 0,0:01:42.42,0:01:43.71,Default,,0000,0000,0000,,macro, what the differences are
Dialogue: 0,0:01:43.71,0:01:47.94,Default,,0000,0000,0000,,between them, and then how to call a
Dialogue: 0,0:01:47.94,0:01:49.86,Default,,0000,0000,0000,,macro instead of the macro also. We'll try to
Dialogue: 0,0:01:49.86,0:01:52.47,Default,,0000,0000,0000,,discuss that one. Because first, let us
Dialogue: 0,0:01:52.47,0:01:56.76,Default,,0000,0000,0000,,see how we can create a non-eval macro.
Dialogue: 0,0:01:56.76,0:02:00.41,Default,,0000,0000,0000,,So now, an eval macro and a non-eval macro--
Dialogue: 0,0:02:00.41,0:02:03.60,Default,,0000,0000,0000,,if you see functionality-wise, both are the
Dialogue: 0,0:02:03.60,0:02:07.02,Default,,0000,0000,0000,,same. So, when we define a macro--the macro
Dialogue: 0,0:02:07.02,0:02:09.89,Default,,0000,0000,0000,,body--you are giving the search string. Right? So,
Dialogue: 0,0:02:09.89,0:02:12.90,Default,,0000,0000,0000,,dynamically at runtime, that
Dialogue: 0,0:02:12.90,0:02:15.67,Default,,0000,0000,0000,,macro will be replaced
Dialogue: 0,0:02:15.67,0:02:18.16,Default,,0000,0000,0000,,by that macro body by Splunk search.
Dialogue: 0,0:02:18.16,0:02:22.81,Default,,0000,0000,0000,,Okay? Now, when we talk about eval-based
Dialogue: 0,0:02:22.81,0:02:26.50,Default,,0000,0000,0000,,macros, it is expected that the macro is
Dialogue: 0,0:02:26.50,0:02:31.05,Default,,0000,0000,0000,,returning a string. When you use a non-eval-based macro,
Dialogue: 0,0:02:31.05,0:02:32.14,Default,,0000,0000,0000,,you can directly put the
Dialogue: 0,0:02:32.14,0:02:34.21,Default,,0000,0000,0000,,search string inside the macro. So, let me
Dialogue: 0,0:02:34.21,0:02:37.24,Default,,0000,0000,0000,,show you. Suppose I want to calculate
Dialogue: 0,0:02:37.24,0:02:40.00,Default,,0000,0000,0000,,total salary based on this formula:
Dialogue: 0,0:02:40.00,0:02:43.24,Default,,0000,0000,0000,,called basic salary. Let me show you.
Dialogue: 0,0:02:43.24,0:02:50.34,Default,,0000,0000,0000,,Basic salary plus basic into the
Dialogue: 0,0:02:50.34,0:02:54.16,Default,,0000,0000,0000,,percentage--variable
Dialogue: 0,0:02:54.16,0:02:58.39,Default,,0000,0000,0000,,percent. Okay? So, to do that--to create any
Dialogue: 0,0:02:58.39,0:03:01.18,Default,,0000,0000,0000,,macro from the Splunk UI--this is how you
Dialogue: 0,0:03:01.18,0:03:03.85,Default,,0000,0000,0000,,do it. You'll go to Settings. We go to
Dialogue: 0,0:03:03.85,0:03:08.17,Default,,0000,0000,0000,,Advanced Search. Okay? From there, if you
Dialogue: 0,0:03:08.17,0:03:11.56,Default,,0000,0000,0000,,see, there is an option called Search Macros.
Dialogue: 0,0:03:11.56,0:03:13.27,Default,,0000,0000,0000,,You go there. You select your app
Dialogue: 0,0:03:13.27,0:03:15.52,Default,,0000,0000,0000,,from there. So, I'll be creating this
Dialogue: 0,0:03:15.52,0:03:17.80,Default,,0000,0000,0000,,macro in my TMDB app. So, I have selected
Dialogue: 0,0:03:17.80,0:03:20.85,Default,,0000,0000,0000,,TMDB over here, then New Search Macro.
Dialogue: 0,0:03:20.85,0:03:23.71,Default,,0000,0000,0000,,Okay? If you see the destination, I've
Dialogue: 0,0:03:23.71,0:03:26.41,Default,,0000,0000,0000,,already selected it as TMDB. I'll give it a
Dialogue: 0,0:03:26.41,0:03:36.15,Default,,0000,0000,0000,,name. Let's say, total salary. Okay? So now,
Dialogue: 0,0:03:36.15,0:03:39.22,Default,,0000,0000,0000,,whether a macro is eval-based or not is
Dialogue: 0,0:03:39.22,0:03:41.20,Default,,0000,0000,0000,,determined by this checkbox. If you
Dialogue: 0,0:03:41.20,0:03:43.02,Default,,0000,0000,0000,,check this one, it will be an eval-based
Dialogue: 0,0:03:43.02,0:03:45.49,Default,,0000,0000,0000,,macro. If you don't check this one,
Dialogue: 0,0:03:45.49,0:03:48.22,Default,,0000,0000,0000,,it will be a non-eval-based macro. So
Dialogue: 0,0:03:48.22,0:03:50.67,Default,,0000,0000,0000,,first, we'll discuss the non-eval-based macro.
Dialogue: 0,0:03:50.67,0:03:51.73,Default,,0000,0000,0000,,So, what I am trying to say
Dialogue: 0,0:03:51.73,0:03:55.18,Default,,0000,0000,0000,,is--whenever we
Dialogue: 0,0:03:55.18,0:03:57.46,Default,,0000,0000,0000,,are creating a non-eval-based macro, we
Dialogue: 0,0:03:57.46,0:03:59.11,Default,,0000,0000,0000,,can directly give a search string over
Dialogue: 0,0:03:59.11,0:04:01.27,Default,,0000,0000,0000,,there. So, my search string will be
Dialogue: 0,0:04:01.27,0:04:03.16,Default,,0000,0000,0000,,something like this. I'll be creating a
Dialogue: 0,0:04:03.16,0:04:05.89,Default,,0000,0000,0000,,new field called total salary. So, that's
Dialogue: 0,0:04:05.89,0:04:13.51,Default,,0000,0000,0000,,why eval total_salary =. Now,
Dialogue: 0,0:04:13.51,0:04:17.38,Default,,0000,0000,0000,,I'll be passing this to my basic
Dialogue: 0,0:04:17.38,0:04:19.87,Default,,0000,0000,0000,,salary and variable percent to this
Dialogue: 0,0:04:19.87,0:04:22.72,Default,,0000,0000,0000,,macro. Right? To do that, what I'll do
Dialogue: 0,0:04:22.72,0:04:26.08,Default,,0000,0000,0000,,is create arguments for this macro:
Dialogue: 0,0:04:26.08,0:04:28.30,Default,,0000,0000,0000,,basic salary. So, in the argument
Dialogue: 0,0:04:28.30,0:04:32.55,Default,,0000,0000,0000,,section, you'll be giving
Dialogue: 0,0:04:32.55,0:04:35.71,Default,,0000,0000,0000,,these two things: basic salary and
Dialogue: 0,0:04:35.71,0:04:40.36,Default,,0000,0000,0000,,variable percent. That's two arguments. As the
Dialogue: 0,0:04:40.36,0:04:42.79,Default,,0000,0000,0000,,macro has two arguments, it is mandatory
Dialogue: 0,0:04:42.79,0:04:46.78,Default,,0000,0000,0000,,that in this Name section, you give how
Dialogue: 0,0:04:46.78,0:04:48.82,Default,,0000,0000,0000,,many number of arguments you have in
Dialogue: 0,0:04:48.82,0:04:50.83,Default,,0000,0000,0000,,your macro. If it is one, you have to give
Dialogue: 0,0:04:50.83,0:04:55.63,Default,,0000,0000,0000,,one here. Okay? Now the formula is: my
Dialogue: 0,0:04:55.63,0:04:59.14,Default,,0000,0000,0000,,basic salary. Now, this basic salary is my
Dialogue: 0,0:04:59.14,0:05:03.01,Default,,0000,0000,0000,,input variable. Right? So, to access input
Dialogue: 0,0:05:03.01,0:05:04.78,Default,,0000,0000,0000,,variables, you access like this--just like
Dialogue: 0,0:05:04.78,0:05:11.77,Default,,0000,0000,0000,,a token. Okay? Basic salary plus my basic
Dialogue: 0,0:05:11.77,0:05:21.16,Default,,0000,0000,0000,,salary into that variable percent. Again,
Dialogue: 0,0:05:21.16,0:05:26.32,Default,,0000,0000,0000,,as input, I am accessing. Right? Then
Dialogue: 0,0:05:26.32,0:05:29.85,Default,,0000,0000,0000,,divided by 100. So, this will be my
Dialogue: 0,0:05:29.85,0:05:33.76,Default,,0000,0000,0000,,macro body. Now, there are two options
Dialogue: 0,0:05:33.76,0:05:35.23,Default,,0000,0000,0000,,for Validation Expression and Validation
Dialogue: 0,0:05:35.23,0:05:36.58,Default,,0000,0000,0000,,Error Message. I will show you in the
Dialogue: 0,0:05:36.58,0:05:42.40,Default,,0000,0000,0000,,next macro. So, if I save it--okay.
Dialogue: 0,0:05:42.40,0:05:44.91,Default,,0000,0000,0000,,So, if you see, the macro has been created.
Dialogue: 0,0:05:44.91,0:05:49.51,Default,,0000,0000,0000,,Now, if I call this macro over here--so to
Dialogue: 0,0:05:49.51,0:05:51.52,Default,,0000,0000,0000,,call a macro, this is how you call: there
Dialogue: 0,0:05:51.52,0:05:54.40,Default,,0000,0000,0000,,is a tick mark, if you see, okay, from your
Dialogue: 0,0:05:54.40,0:06:01.06,Default,,0000,0000,0000,,keyboard, then the macro name--total
Dialogue: 0,0:06:01.06,0:06:04.69,Default,,0000,0000,0000,,salary--and it has two arguments, right? My
Dialogue: 0,0:06:04.69,0:06:08.70,Default,,0000,0000,0000,,basic salary and my variable percent,
Dialogue: 0,0:06:08.70,0:06:13.15,Default,,0000,0000,0000,,then tick end. Now, this basic salary
Dialogue: 0,0:06:13.15,0:06:15.13,Default,,0000,0000,0000,,corresponds to this basic salary, and
Dialogue: 0,0:06:15.13,0:06:16.72,Default,,0000,0000,0000,,variable percent corresponds to this
Dialogue: 0,0:06:16.72,0:06:18.07,Default,,0000,0000,0000,,variable percent field.
Dialogue: 0,0:06:18.07,0:06:21.28,Default,,0000,0000,0000,,Now, when you define the macro, I have
Dialogue: 0,0:06:21.28,0:06:23.05,Default,,0000,0000,0000,,given the same name as the macro input. You
Dialogue: 0,0:06:23.05,0:06:26.08,Default,,0000,0000,0000,,can give any input variable name
Dialogue: 0,0:06:26.08,0:06:28.00,Default,,0000,0000,0000,,over here. The same name you have to use
Dialogue: 0,0:06:28.00,0:06:30.58,Default,,0000,0000,0000,,over here as well. But when you pass the
Dialogue: 0,0:06:30.58,0:06:33.76,Default,,0000,0000,0000,,macro--pass this with basic salary and variable
Dialogue: 0,0:06:33.76,0:06:35.86,Default,,0000,0000,0000,,percent to this macro--you'll be giving
Dialogue: 0,0:06:35.86,0:06:37.45,Default,,0000,0000,0000,,the field names only. Okay?
Dialogue: 0,0:06:37.45,0:06:40.27,Default,,0000,0000,0000,,So, let us run it and see what's going on.
Dialogue: 0,0:06:40.27,0:06:43.89,Default,,0000,0000,0000,,If you see, it has created a total salary
Dialogue: 0,0:06:43.89,0:06:47.65,Default,,0000,0000,0000,,field with this formula output--4,000 plus
Dialogue: 0,0:06:47.65,0:06:51.82,Default,,0000,0000,0000,,4,000 into 15% is 4,600. Right? So, it is
Dialogue: 0,0:06:51.82,0:06:54.64,Default,,0000,0000,0000,,basically the same as what is
Dialogue: 0,0:06:54.64,0:06:58.12,Default,,0000,0000,0000,,happening at runtime. So, if
Dialogue: 0,0:06:58.12,0:07:00.10,Default,,0000,0000,0000,,instead of total salary, I just gave
Dialogue: 0,0:07:00.10,0:07:04.30,Default,,0000,0000,0000,,this one, and instead of this token
Dialogue: 0,0:07:04.30,0:07:07.96,Default,,0000,0000,0000,,variable, I just gave my field name here,
Dialogue: 0,0:07:07.96,0:07:14.49,Default,,0000,0000,0000,,the output will be the same--variable percent.
Dialogue: 0,0:07:14.49,0:07:18.52,Default,,0000,0000,0000,,The output will be the same. So, this is also
Dialogue: 0,0:07:18.52,0:07:21.49,Default,,0000,0000,0000,,what is happening as well. So, at runtime,
Dialogue: 0,0:07:21.49,0:07:25.06,Default,,0000,0000,0000,,Splunk is replacing this macro body with
Dialogue: 0,0:07:25.06,0:07:28.03,Default,,0000,0000,0000,,these variable inputs, and then it is
Dialogue: 0,0:07:28.03,0:07:29.71,Default,,0000,0000,0000,,running the query. So ultimately, this
Dialogue: 0,0:07:29.71,0:07:32.74,Default,,0000,0000,0000,,query is getting run. Okay? But the
Dialogue: 0,0:07:32.74,0:07:34.96,Default,,0000,0000,0000,,thing is--this code, if you put it in
Dialogue: 0,0:07:34.96,0:07:36.91,Default,,0000,0000,0000,,a macro--you can call that macro anywhere
Dialogue: 0,0:07:36.91,0:07:39.13,Default,,0000,0000,0000,,in usage. So that means this code
Dialogue: 0,0:07:39.13,0:07:42.49,Default,,0000,0000,0000,,portion will be reusable now. Okay? Now,
Dialogue: 0,0:07:42.49,0:07:46.15,Default,,0000,0000,0000,,let's see an example where we can use
Dialogue: 0,0:07:46.15,0:07:47.68,Default,,0000,0000,0000,,this validation expression and
Dialogue: 0,0:07:47.68,0:07:49.27,Default,,0000,0000,0000,,validation error message. Now,
Dialogue: 0,0:07:49.27,0:07:51.70,Default,,0000,0000,0000,,validation expression is used when you
Dialogue: 0,0:07:51.70,0:07:54.82,Default,,0000,0000,0000,,want to do some kind of validation on
Dialogue: 0,0:07:54.82,0:08:00.28,Default,,0000,0000,0000,,your macro inputs. Okay? And validation
Dialogue: 0,0:08:00.28,0:08:02.83,Default,,0000,0000,0000,,error message means when this input is
Dialogue: 0,0:08:02.83,0:08:04.75,Default,,0000,0000,0000,,getting--or this validation is getting--
Dialogue: 0,0:08:04.75,0:08:06.43,Default,,0000,0000,0000,,failed, this error message will be
Dialogue: 0,0:08:06.43,0:08:09.46,Default,,0000,0000,0000,,displayed over there. So, to do that, what
Dialogue: 0,0:08:09.46,0:08:14.64,Default,,0000,0000,0000,,I'll do is create another macro.
Dialogue: 0,0:08:14.64,0:08:20.11,Default,,0000,0000,0000,,Okay? So now, let's say, we have basic
Dialogue: 0,0:08:20.11,0:08:22.57,Default,,0000,0000,0000,,salary and variable percent. Right? Let's
Dialogue: 0,0:08:22.57,0:08:24.79,Default,,0000,0000,0000,,say we want to calculate a bonus
Dialogue: 0,0:08:24.79,0:08:27.67,Default,,0000,0000,0000,,percentage with this formula: called
Dialogue: 0,0:08:27.67,0:08:32.35,Default,,0000,0000,0000,,variable percent plus any other percent--
Dialogue: 0,0:08:32.35,0:08:35.62,Default,,0000,0000,0000,,any number. Let's say, any number--
Dialogue: 0,0:08:35.62,0:08:37.93,Default,,0000,0000,0000,,7% or 8%, any number
Dialogue: 0,0:08:37.93,0:08:40.54,Default,,0000,0000,0000,,I’ll put for our inputs. It'll give me--it'll
Dialogue: 0,0:08:40.54,0:08:43.06,Default,,0000,0000,0000,,add those two percentage values and
Dialogue: 0,0:08:43.06,0:08:45.61,Default,,0000,0000,0000,,give me the bonus percent. Okay? So, to do
Dialogue: 0,0:08:45.61,0:08:48.28,Default,,0000,0000,0000,,that, I'll just create that similar
Dialogue: 0,0:08:48.28,0:08:51.11,Default,,0000,0000,0000,,macro named "bonus."
Dialogue: 0,0:08:52.11,0:08:56.68,Default,,0000,0000,0000,,Okay? So, the formula will be--again--it
Dialogue: 0,0:08:56.68,0:09:09.57,Default,,0000,0000,0000,,will be non-eval-based. Okay? eval bonus =.
Dialogue: 0,0:09:09.57,0:09:13.84,Default,,0000,0000,0000,,So, my variable percent, right,
Dialogue: 0,0:09:13.84,0:09:16.27,Default,,0000,0000,0000,,I have to provide as an input, so I'll be
Dialogue: 0,0:09:16.27,0:09:18.79,Default,,0000,0000,0000,,giving input. So, let's say this time I
Dialogue: 0,0:09:18.79,0:09:21.61,Default,,0000,0000,0000,,will rename this to something--VP. So,
Dialogue: 0,0:09:21.61,0:09:27.81,Default,,0000,0000,0000,,I'll say $VP$, then plus
Dialogue: 0,0:09:27.81,0:09:30.58,Default,,0000,0000,0000,,another input I'll be giving--let's say,
Dialogue: 0,0:09:30.58,0:09:36.54,Default,,0000,0000,0000,,bonus input. Okay? So, this bonus, I'll be
Dialogue: 0,0:09:36.54,0:09:42.19,Default,,0000,0000,0000,,adding here. Okay. Bonus. So, we have two
Dialogue: 0,0:09:42.19,0:09:44.08,Default,,0000,0000,0000,,inputs. That means we have to give two
Dialogue: 0,0:09:44.08,0:09:47.44,Default,,0000,0000,0000,,over here. Now I'll add an expression. Now,
Dialogue: 0,0:09:47.44,0:09:50.26,Default,,0000,0000,0000,,I always want this bonus to be a number.
Dialogue: 0,0:09:50.26,0:09:53.59,Default,,0000,0000,0000,,Okay? To do that--so, this validation
Dialogue: 0,0:09:53.59,0:09:55.69,Default,,0000,0000,0000,,expression has to be a Boolean
Dialogue: 0,0:09:55.69,0:09:59.08,Default,,0000,0000,0000,,expression or eval. Okay? So, if you saw my
Dialogue: 0,0:09:59.08,0:10:01.21,Default,,0000,0000,0000,,previous video, we discussed the
Dialogue: 0,0:10:01.21,0:10:04.39,Default,,0000,0000,0000,,various eval expressions. Right? And some
Dialogue: 0,0:10:04.39,0:10:06.16,Default,,0000,0000,0000,,of the expressions return Boolean--like
Dialogue: 0,0:10:06.16,0:10:08.80,Default,,0000,0000,0000,,the like operator, in operator, or
Dialogue: 0,0:10:08.80,0:10:11.77,Default,,0000,0000,0000,,isnum operator, which basically checks
Dialogue: 0,0:10:11.77,0:10:15.22,Default,,0000,0000,0000,,whether a particular input is a number or
Dialogue: 0,0:10:15.22,0:10:17.23,Default,,0000,0000,0000,,not. So, we'll be using isnum over
Dialogue: 0,0:10:17.23,0:10:20.53,Default,,0000,0000,0000,,here on this bonus. That means I am
Dialogue: 0,0:10:20.53,0:10:23.29,Default,,0000,0000,0000,,checking whether whatever I am providing
Dialogue: 0,0:10:23.29,0:10:25.38,Default,,0000,0000,0000,,as input to this bonus variable
Dialogue: 0,0:10:25.38,0:10:28.63,Default,,0000,0000,0000,,parameter is a number or not. If
Dialogue: 0,0:10:28.63,0:10:32.35,Default,,0000,0000,0000,,it is not a number, I'll give this
Dialogue: 0,0:10:32.35,0:10:36.67,Default,,0000,0000,0000,,output error message: "Bonus must
Dialogue: 0,0:10:36.67,0:10:41.49,Default,,0000,0000,0000,,be a number." Okay?
Dialogue: 0,0:10:41.49,0:10:50.11,Default,,0000,0000,0000,,So, let's save this macro. Okay? Now I will
Dialogue: 0,0:10:50.11,0:10:56.95,Default,,0000,0000,0000,,call this macro here. Let it be--my total
Dialogue: 0,0:10:56.95,0:11:01.78,Default,,0000,0000,0000,,salary macro called as--is. If I just do
Dialogue: 0,0:11:01.78,0:11:03.53,Default,,0000,0000,0000,,Ctrl+C--
Dialogue: 0,0:11:03.53,0:11:06.53,Default,,0000,0000,0000,,okay. Here, I am calling my total salary. So
Dialogue: 0,0:11:06.53,0:11:08.93,Default,,0000,0000,0000,,just tick the output. Now, after that, I'll
Dialogue: 0,0:11:08.93,0:11:14.93,Default,,0000,0000,0000,,be calling the bonus macro. Right? So,
Dialogue: 0,0:11:14.93,0:11:17.96,Default,,0000,0000,0000,,similar way: tick, macro name, macro
Dialogue: 0,0:11:17.96,0:11:19.76,Default,,0000,0000,0000,,inputs. One of the inputs will be my
Dialogue: 0,0:11:19.76,0:11:22.82,Default,,0000,0000,0000,,variable percent, and another
Dialogue: 0,0:11:22.82,0:11:25.79,Default,,0000,0000,0000,,input maybe--let's say, 8% I want
Dialogue: 0,0:11:25.79,0:11:28.40,Default,,0000,0000,0000,,to add to the variable percent. So, what
Dialogue: 0,0:11:28.40,0:11:30.77,Default,,0000,0000,0000,,will be the output? In this case, it should
Dialogue: 0,0:11:30.77,0:11:33.56,Default,,0000,0000,0000,,create a new field called "bonus" with 15
Dialogue: 0,0:11:33.56,0:11:35.78,Default,,0000,0000,0000,,plus 8, 20 plus 8—something like this.
Dialogue: 0,0:11:35.78,0:11:39.40,Default,,0000,0000,0000,,Okay? If you see, you can
Dialogue: 0,0:11:39.40,0:11:41.87,Default,,0000,0000,0000,,access different macros in
Dialogue: 0,0:11:41.87,0:11:48.14,Default,,0000,0000,0000,,your whole search. Okay? Now, let's say I
Dialogue: 0,0:11:48.14,0:11:52.57,Default,,0000,0000,0000,,have provided a string here--it says test.
Dialogue: 0,0:11:52.57,0:11:55.28,Default,,0000,0000,0000,,Okay. What is happening? So, if you provide
Dialogue: 0,0:11:55.28,0:11:57.77,Default,,0000,0000,0000,,a string here, that validation is
Dialogue: 0,0:11:57.77,0:11:59.66,Default,,0000,0000,0000,,getting failed. We have added over here
Dialogue: 0,0:11:59.66,0:12:02.45,Default,,0000,0000,0000,,isnum. So, that's why it is giving you this
Dialogue: 0,0:12:02.45,0:12:05.51,Default,,0000,0000,0000,,error: "Bonus must be a number." So, this is
Dialogue: 0,0:12:05.51,0:12:10.25,Default,,0000,0000,0000,,how macro input validation works. Okay. Let
Dialogue: 0,0:12:10.25,0:12:15.28,Default,,0000,0000,0000,,us continue. Now, we will discuss
Dialogue: 0,0:12:15.28,0:12:18.83,Default,,0000,0000,0000,,how to create an eval macro. So, to do
Dialogue: 0,0:12:18.83,0:12:22.52,Default,,0000,0000,0000,,that, what we'll do is--first, let me show
Dialogue: 0,0:12:22.52,0:12:24.92,Default,,0000,0000,0000,,you two things. If you remember from my
Dialogue: 0,0:12:24.92,0:12:28.22,Default,,0000,0000,0000,,previous video, we created a command
Dialogue: 0,0:12:28.22,0:12:31.94,Default,,0000,0000,0000,,called getjournals. Right? And that
Dialogue: 0,0:12:31.94,0:12:33.80,Default,,0000,0000,0000,,command takes an input with the journal
Dialogue: 0,0:12:33.80,0:12:36.41,Default,,0000,0000,0000,,ID. And if we are not giving any journal
Dialogue: 0,0:12:36.41,0:12:38.78,Default,,0000,0000,0000,,ID and we are giving *, it will give you all
Dialogue: 0,0:12:38.78,0:12:41.78,Default,,0000,0000,0000,,the journal details. Right? And also, we
Dialogue: 0,0:12:41.78,0:12:47.63,Default,,0000,0000,0000,,have... We have created a...
Dialogue: 0,0:12:47.63,0:12:50.75,Default,,0000,0000,0000,,We have indexed our data into this main index.
Dialogue: 0,0:12:50.75,0:12:52.13,Default,,0000,0000,0000,,Right? So, we have another dataset
Dialogue: 0,0:12:52.13,0:12:54.20,Default,,0000,0000,0000,,called "main" where we are having
Dialogue: 0,0:12:54.20,0:12:56.27,Default,,0000,0000,0000,,this salary and this information. Just
Dialogue: 0,0:12:56.27,0:12:58.52,Default,,0000,0000,0000,,now we are working with this dataset. So,
Dialogue: 0,0:12:58.52,0:13:01.00,Default,,0000,0000,0000,,suppose there is a requirement that,
Dialogue: 0,0:13:01.00,0:13:04.73,Default,,0000,0000,0000,,based on a certain condition, either I need
Dialogue: 0,0:13:04.73,0:13:09.11,Default,,0000,0000,0000,,to go with this dataset or I need to go
Dialogue: 0,0:13:09.11,0:13:11.33,Default,,0000,0000,0000,,with that dataset. In this type of
Dialogue: 0,0:13:11.33,0:13:13.73,Default,,0000,0000,0000,,scenario--where dynamically you have to
Dialogue: 0,0:13:13.73,0:13:15.98,Default,,0000,0000,0000,,determine which dataset to work on, or
Dialogue: 0,0:13:15.98,0:13:17.33,Default,,0000,0000,0000,,dynamically determine
Dialogue: 0,0:13:17.33,0:13:22.55,Default,,0000,0000,0000,,which search string to return--
Dialogue: 0,0:13:22.55,0:13:25.10,Default,,0000,0000,0000,,eval macros
Dialogue: 0,0:13:25.10,0:13:28.49,Default,,0000,0000,0000,,come into the picture. Okay? Because the
Dialogue: 0,0:13:28.49,0:13:31.13,Default,,0000,0000,0000,,main concept behind an eval macro is it has
Dialogue: 0,0:13:31.13,0:13:34.28,Default,,0000,0000,0000,,to return a string. So, in that case, how
Dialogue: 0,0:13:34.28,0:13:36.41,Default,,0000,0000,0000,,you will create it is like this. Let's say,
Dialogue: 0,0:13:36.41,0:13:39.53,Default,,0000,0000,0000,,new search macro. I'll give a name called
Dialogue: 0,0:13:39.53,0:13:46.58,Default,,0000,0000,0000,,getjournal_or_mainindex. Okay? Just
Dialogue: 0,0:13:46.58,0:13:48.68,Default,,0000,0000,0000,,like a name to show you the use
Dialogue: 0,0:13:48.68,0:13:51.98,Default,,0000,0000,0000,,case of it. So, here, what I will write--
Dialogue: 0,0:13:51.98,0:13:53.90,Default,,0000,0000,0000,,I’ll write an if or case statement. Generally,
Dialogue: 0,0:13:53.90,0:13:55.49,Default,,0000,0000,0000,,we mostly write an if or case
Dialogue: 0,0:13:55.49,0:13:59.33,Default,,0000,0000,0000,,statement for eval-based macros,
Dialogue: 0,0:13:59.33,0:14:02.09,Default,,0000,0000,0000,,so that we can have different
Dialogue: 0,0:14:02.09,0:14:03.47,Default,,0000,0000,0000,,conditions, and based on the condition, we
Dialogue: 0,0:14:03.47,0:14:05.24,Default,,0000,0000,0000,,return the search string. But
Dialogue: 0,0:14:05.24,0:14:07.22,Default,,0000,0000,0000,,ultimately, if you see, we’re returning the
Dialogue: 0,0:14:07.22,0:14:09.02,Default,,0000,0000,0000,,search string only at the end of the day--
Dialogue: 0,0:14:09.02,0:14:11.03,Default,,0000,0000,0000,,so that Splunk will replace that macro
Dialogue: 0,0:14:11.03,0:14:13.40,Default,,0000,0000,0000,,with that search string. So, I’m saying I’ll
Dialogue: 0,0:14:13.40,0:14:17.65,Default,,0000,0000,0000,,provide the argument here. Let’s say,
Dialogue: 0,0:14:17.65,0:14:21.17,Default,,0000,0000,0000,,same argument name. So,
Dialogue: 0,0:14:21.17,0:14:23.36,Default,,0000,0000,0000,,either I’ll provide getjournal, or I’ll
Dialogue: 0,0:14:23.36,0:14:25.88,Default,,0000,0000,0000,,provide main as my argument
Dialogue: 0,0:14:25.88,0:14:27.98,Default,,0000,0000,0000,,value. Okay? I’ll show you how I
Dialogue: 0,0:14:27.98,0:14:29.29,Default,,0000,0000,0000,,provide that one.
Dialogue: 0,0:14:29.29,0:14:42.34,Default,,0000,0000,0000,,case($input$ == "getjournal", "getjournals *", $input$ == "main", "search index=main")
Dialogue: 0,0:14:42.34,0:14:46.64,Default,,0000,0000,0000,,As it is within quotes, remember that this one
Dialogue: 0,0:14:46.64,0:14:49.70,Default,,0000,0000,0000,,has to be in quotes as well. Or, when you are
Dialogue: 0,0:14:49.70,0:14:51.56,Default,,0000,0000,0000,,calling it, you have to call with
Dialogue: 0,0:14:51.56,0:14:53.84,Default,,0000,0000,0000,,quotes. I prefer it like this only so
Dialogue: 0,0:14:53.84,0:14:55.61,Default,,0000,0000,0000,,that everything is inside your
Dialogue: 0,0:14:55.61,0:14:58.70,Default,,0000,0000,0000,,macro. In that case, the string I
Dialogue: 0,0:14:58.70,0:15:04.100,Default,,0000,0000,0000,,will return is this command: getjournals *.
Dialogue: 0,0:15:04.100,0:15:07.13,Default,,0000,0000,0000,,Now, you have to be very careful over
Dialogue: 0,0:15:07.13,0:15:10.46,Default,,0000,0000,0000,,here when you deal with a generating
Dialogue: 0,0:15:10.46,0:15:11.87,Default,,0000,0000,0000,,command. If you see, getjournals is a
Dialogue: 0,0:15:11.87,0:15:13.61,Default,,0000,0000,0000,,generating command. Right? That’s why this
Dialogue: 0,0:15:13.61,0:15:15.02,Default,,0000,0000,0000,,has to be the first command in your
Dialogue: 0,0:15:15.02,0:15:19.87,Default,,0000,0000,0000,,search string. Now, for generating commands,
Dialogue: 0,0:15:19.87,0:15:22.55,Default,,0000,0000,0000,,when you run it--if you see--there is a
Dialogue: 0,0:15:22.55,0:15:25.22,Default,,0000,0000,0000,,bar (|) over here in the search bar. Right? After
Dialogue: 0,0:15:25.22,0:15:27.05,Default,,0000,0000,0000,,that only, if I run this command without
Dialogue: 0,0:15:27.05,0:15:29.81,Default,,0000,0000,0000,,this bar, nothing will come up. So,
Dialogue: 0,0:15:29.81,0:15:32.15,Default,,0000,0000,0000,,it requires this bar. But when you put
Dialogue: 0,0:15:32.15,0:15:35.48,Default,,0000,0000,0000,,this getjournals *--this generating
Dialogue: 0,0:15:35.48,0:15:38.96,Default,,0000,0000,0000,,command--inside a macro, you put it
Dialogue: 0,0:15:38.96,0:15:41.09,Default,,0000,0000,0000,,without the bar, so that when you call
Dialogue: 0,0:15:41.09,0:15:43.94,Default,,0000,0000,0000,,the macro, you’ll call with | then
Dialogue: 0,0:15:43.94,0:15:45.32,Default,,0000,0000,0000,,macro name. I’ll show you that one as
Dialogue: 0,0:15:45.32,0:15:47.66,Default,,0000,0000,0000,,well. That’s why I’m giving it without
Dialogue: 0,0:15:47.66,0:15:50.54,Default,,0000,0000,0000,,the bar here. This is important--you have to be very
Dialogue: 0,0:15:50.54,0:15:53.11,Default,,0000,0000,0000,,careful with generating commands.
Dialogue: 0,0:15:53.11,0:15:55.31,Default,,0000,0000,0000,,Because if you put the bar inside, it will
Dialogue: 0,0:15:55.31,0:16:01.07,Default,,0000,0000,0000,,not work. Now, when my input is "main"--okay--in
Dialogue: 0,0:16:01.07,0:16:04.58,Default,,0000,0000,0000,,that case, I will return the string
Dialogue: 0,0:16:04.58,0:16:10.31,Default,,0000,0000,0000,,called search index=main. Here
Dialogue: 0,0:16:10.31,0:16:12.62,Default,,0000,0000,0000,,also, another good thing is when you run
Dialogue: 0,0:16:12.62,0:16:14.54,Default,,0000,0000,0000,,index=main from your search
Dialogue: 0,0:16:14.54,0:16:16.67,Default,,0000,0000,0000,,prompt, you do not need to mention
Dialogue: 0,0:16:16.67,0:16:18.68,Default,,0000,0000,0000,,search then index=main,
Dialogue: 0,0:16:18.68,0:16:21.83,Default,,0000,0000,0000,,because that comes by default. But
Dialogue: 0,0:16:21.83,0:16:23.90,Default,,0000,0000,0000,,when you use it in a macro or somewhere
Dialogue: 0,0:16:23.90,0:16:24.23,Default,,0000,0000,0000,,else,
Dialogue: 0,0:16:24.23,0:16:27.11,Default,,0000,0000,0000,,you have to put it like this: search
Dialogue: 0,0:16:27.11,0:16:31.16,Default,,0000,0000,0000,,index=main. Okay? So, this string I’ll
Dialogue: 0,0:16:31.16,0:16:33.35,Default,,0000,0000,0000,,be returning. Since the macro has one
Dialogue: 0,0:16:33.35,0:16:37.07,Default,,0000,0000,0000,,input, I’ll be giving 1 here. Okay? For now,
Dialogue: 0,0:16:37.07,0:16:39.23,Default,,0000,0000,0000,,validation. We are not doing anything,
Dialogue: 0,0:16:39.23,0:16:44.39,Default,,0000,0000,0000,,so let’s save it. Okay? This is our third
Dialogue: 0,0:16:44.39,0:16:48.77,Default,,0000,0000,0000,,macro--getjournal_or_main. So, if I
Dialogue: 0,0:16:48.77,0:16:53.75,Default,,0000,0000,0000,,run this macro now--okay--as I said, it
Dialogue: 0,0:16:53.75,0:16:56.15,Default,,0000,0000,0000,,has a generating command, that’s why I’m
Dialogue: 0,0:16:56.15,0:16:59.96,Default,,0000,0000,0000,,giving a bar over here, then my tick, and
Dialogue: 0,0:16:59.96,0:17:03.68,Default,,0000,0000,0000,,then my input. Let’s say I’ll be giving
Dialogue: 0,0:17:03.68,0:17:09.53,Default,,0000,0000,0000,,input as getjournal. I
Dialogue: 0,0:17:09.53,0:17:13.29,Default,,0000,0000,0000,,want to work with the dataset getjournal. Okay?
Dialogue: 0,0:17:13.29,0:17:21.22,Default,,0000,0000,0000,,Let’s see. Okay. I have a
Dialogue: 0,0:17:21.22,0:17:28.37,Default,,0000,0000,0000,,bracket that’s missing over here. Save.
Dialogue: 0,0:17:28.37,0:17:30.02,Default,,0000,0000,0000,,If you see, if I run this macro again, it
Dialogue: 0,0:17:30.02,0:17:31.64,Default,,0000,0000,0000,,is giving me the same because sometimes it
Dialogue: 0,0:17:31.64,0:17:34.52,Default,,0000,0000,0000,,doesn’t take the refreshed value.
Dialogue: 0,0:17:34.52,0:17:36.62,Default,,0000,0000,0000,,So, what I’ll do in this case--just copy
Dialogue: 0,0:17:36.62,0:17:41.69,Default,,0000,0000,0000,,this code, close it, run it again.
Dialogue: 0,0:17:41.69,0:17:43.77,Default,,0000,0000,0000,,SearchFactory Unknown search command
Dialogue: 0,0:17:43.77,0:17:55.85,Default,,0000,0000,0000,,'case'. Let’s see what’s going on. Okay. It
Dialogue: 0,0:17:55.85,0:17:58.28,Default,,0000,0000,0000,,has to be an eval-based macro because it is
Dialogue: 0,0:17:58.28,0:18:01.19,Default,,0000,0000,0000,,returning a string now. Right? So, let’s
Dialogue: 0,0:18:01.19,0:18:10.76,Default,,0000,0000,0000,,save it, and let’s rerun it. Okay. It is not-- Okay. Now, if you
Dialogue: 0,0:18:10.76,0:18:13.91,Default,,0000,0000,0000,,see, if I run this getjournal macro,
Dialogue: 0,0:18:13.91,0:18:15.41,Default,,0000,0000,0000,,it is giving me this dataset where it
Dialogue: 0,0:18:15.41,0:18:17.23,Default,,0000,0000,0000,,is running that getjournal *
Dialogue: 0,0:18:17.23,0:18:19.13,Default,,0000,0000,0000,,generating command and giving me this
Dialogue: 0,0:18:19.13,0:18:23.51,Default,,0000,0000,0000,,result. If I say main, in this case, it is
Dialogue: 0,0:18:23.51,0:18:26.09,Default,,0000,0000,0000,,giving me this dataset where I have
Dialogue: 0,0:18:26.09,0:18:29.75,Default,,0000,0000,0000,,indexed my data. So, this is how you can
Dialogue: 0,0:18:29.75,0:18:33.02,Default,,0000,0000,0000,,create an eval-based macro. Okay? So now,
Dialogue: 0,0:18:33.02,0:18:36.77,Default,,0000,0000,0000,,macros have different permissions as
Dialogue: 0,0:18:36.77,0:18:39.59,Default,,0000,0000,0000,,well. If you see from this macro
Dialogue: 0,0:18:39.59,0:18:44.09,Default,,0000,0000,0000,,list page, you can set the
Dialogue: 0,0:18:44.09,0:18:46.43,Default,,0000,0000,0000,,permissions as well. So currently, I'll
Dialogue: 0,0:18:46.43,0:18:48.05,Default,,0000,0000,0000,,show you. I'll set this permission as
Dialogue: 0,0:18:48.05,0:18:50.33,Default,,0000,0000,0000,,"this app only" and read--I'll say
Dialogue: 0,0:18:50.33,0:18:52.94,Default,,0000,0000,0000,,everyone, and write--let's say, admin. Let's
Dialogue: 0,0:18:52.94,0:18:57.38,Default,,0000,0000,0000,,do it for all the macro permissions. So,
Dialogue: 0,0:18:57.38,0:18:58.52,Default,,0000,0000,0000,,you have to be very careful with the
Dialogue: 0,0:18:58.52,0:19:02.48,Default,,0000,0000,0000,,macro permissions as well. Otherwise, any
Dialogue: 0,0:19:02.48,0:19:04.52,Default,,0000,0000,0000,,unprivileged user will not be able to
Dialogue: 0,0:19:04.52,0:19:07.10,Default,,0000,0000,0000,,run this macro, and your dashboard will
Dialogue: 0,0:19:07.10,0:19:11.89,Default,,0000,0000,0000,,not show up anything. So, read--right. Okay.
Dialogue: 0,0:19:11.89,0:19:14.33,Default,,0000,0000,0000,,Now, we have set the permissions of the
Dialogue: 0,0:19:14.33,0:19:17.12,Default,,0000,0000,0000,,macro as well. Now, let's see what's going
Dialogue: 0,0:19:17.12,0:19:19.49,Default,,0000,0000,0000,,on in the background. So, I am in my
Dialogue: 0,0:19:19.49,0:19:24.99,Default,,0000,0000,0000,,Splunk home. I'll go to etc/apps/tmdb_app/,
Dialogue: 0,0:19:24.99,0:19:26.99,Default,,0000,0000,0000,,and I'll go to my local folder. If
Dialogue: 0,0:19:26.99,0:19:28.97,Default,,0000,0000,0000,,you see, whenever you create a macro,
Dialogue: 0,0:19:28.97,0:19:31.22,Default,,0000,0000,0000,,it creates another conf file called
Dialogue: 0,0:19:31.22,0:19:34.10,Default,,0000,0000,0000,,macros.conf. I'll open this file. And
Dialogue: 0,0:19:34.10,0:19:37.19,Default,,0000,0000,0000,,if you see all the different macros we have
Dialogue: 0,0:19:37.19,0:19:39.08,Default,,0000,0000,0000,,created, it creates separate
Dialogue: 0,0:19:39.08,0:19:43.04,Default,,0000,0000,0000,,stanzas for each macro name with all
Dialogue: 0,0:19:43.04,0:19:45.92,Default,,0000,0000,0000,,the input numbers. Right? And args are the
Dialogue: 0,0:19:45.92,0:19:49.07,Default,,0000,0000,0000,,inputs of these macros. Right? For bonus, if
Dialogue: 0,0:19:49.07,0:19:52.82,Default,,0000,0000,0000,,you see here, my arguments are
Dialogue: 0,0:19:52.82,0:19:55.52,Default,,0000,0000,0000,,VP and bonus. Right? Two arguments--those are
Dialogue: 0,0:19:55.52,0:19:56.84,Default,,0000,0000,0000,,showing up here. This is
Dialogue: 0,0:19:56.84,0:19:59.24,Default,,0000,0000,0000,,the macro definition. This is the error
Dialogue: 0,0:19:59.24,0:20:02.03,Default,,0000,0000,0000,,message you set for this macro. This
Dialogue: 0,0:20:02.03,0:20:03.32,Default,,0000,0000,0000,,is the validation you have set for
Dialogue: 0,0:20:03.32,0:20:06.47,Default,,0000,0000,0000,,this macro. And iseval is telling
Dialogue: 0,0:20:06.47,0:20:08.48,Default,,0000,0000,0000,,you whether this macro is eval-based or
Dialogue: 0,0:20:08.48,0:20:11.52,Default,,0000,0000,0000,,not. As our last macro, getjournal_or_main,
Dialogue: 0,0:20:11.52,0:20:13.79,Default,,0000,0000,0000,,is eval-based, that's why iseval is
Dialogue: 0,0:20:13.79,0:20:16.13,Default,,0000,0000,0000,,1. For the rest of the two macros, iseval
Dialogue: 0,0:20:16.13,0:20:21.08,Default,,0000,0000,0000,,is 0. Okay? Now, you can call a
Dialogue: 0,0:20:21.08,0:20:23.78,Default,,0000,0000,0000,,macro inside another macro. So, to
Dialogue: 0,0:20:23.78,0:20:26.69,Default,,0000,0000,0000,,do that, let's do this exercise where we
Dialogue: 0,0:20:26.69,0:20:28.49,Default,,0000,0000,0000,,have created this totalsalary, right?
Dialogue: 0,0:20:28.49,0:20:29.93,Default,,0000,0000,0000,,And also bonus.
Dialogue: 0,0:20:29.93,0:20:31.94,Default,,0000,0000,0000,,So, inside totalsalary, we'll try to
Dialogue: 0,0:20:31.94,0:20:35.06,Default,,0000,0000,0000,,call this bonus one. To do that, I'll
Dialogue: 0,0:20:35.06,0:20:38.82,Default,,0000,0000,0000,,do one thing. I'll clone this totalsalary macro.
Dialogue: 0,0:20:38.82,0:20:40.31,Default,,0000,0000,0000,,No--let's just
Dialogue: 0,0:20:40.31,0:20:51.35,Default,,0000,0000,0000,,get a new one only. Let's say, totalsalary_v2 (version two).
Dialogue: 0,0:20:51.35,0:20:53.87,Default,,0000,0000,0000,,Okay? So, what I will do--it will
Dialogue: 0,0:20:53.87,0:20:57.20,Default,,0000,0000,0000,,not be an eval-based macro. Let's say my
Dialogue: 0,0:20:57.20,0:21:01.85,Default,,0000,0000,0000,,previous one was eval, right? So,
Dialogue: 0,0:21:01.85,0:21:06.20,Default,,0000,0000,0000,,it has two arguments: basic_salary and
Dialogue: 0,0:21:06.20,0:21:11.15,Default,,0000,0000,0000,,variable_percent. Right? Now, I'll be
Dialogue: 0,0:21:11.15,0:21:14.42,Default,,0000,0000,0000,,adding this bonus as well. So, bonus
Dialogue: 0,0:21:14.42,0:21:16.28,Default,,0000,0000,0000,,requires another extra input called
Dialogue: 0,0:21:16.28,0:21:19.46,Default,,0000,0000,0000,,bonus, right? So, I'll be adding this as
Dialogue: 0,0:21:19.46,0:21:23.18,Default,,0000,0000,0000,,an extra input--comma, this. So, my total
Dialogue: 0,0:21:23.18,0:21:27.02,Default,,0000,0000,0000,,macro inputs will be three. basic_salary
Dialogue: 0,0:21:27.02,0:21:29.75,Default,,0000,0000,0000,,and variable_percent will be used
Dialogue: 0,0:21:29.75,0:21:33.02,Default,,0000,0000,0000,,here, and variable_percent and bonus will be
Dialogue: 0,0:21:33.02,0:21:35.66,Default,,0000,0000,0000,,used in another eval statement,
Dialogue: 0,0:21:35.66,0:21:37.73,Default,,0000,0000,0000,,which you'll be calling in this
Dialogue: 0,0:21:37.73,0:21:40.76,Default,,0000,0000,0000,,bonus macro. Right? So, in this case, I'll
Dialogue: 0,0:21:40.76,0:21:44.36,Default,,0000,0000,0000,,be calling this bonus macro inside. So,
Dialogue: 0,0:21:44.36,0:21:48.83,Default,,0000,0000,0000,,I'll set this one—pipe, then my bonus
Dialogue: 0,0:21:48.83,0:21:51.55,Default,,0000,0000,0000,,macro. bonus macro takes two arguments.
Dialogue: 0,0:21:51.55,0:21:54.83,Default,,0000,0000,0000,,One is variable_percent, and another is
Dialogue: 0,0:21:54.83,0:21:59.66,Default,,0000,0000,0000,,bonus. So, variable_percent I'll pass, and
Dialogue: 0,0:21:59.66,0:22:04.37,Default,,0000,0000,0000,,I'll pass this bonus as well. So, ideally,
Dialogue: 0,0:22:04.37,0:22:06.74,Default,,0000,0000,0000,,the behavior should be the same as we have
Dialogue: 0,0:22:06.74,0:22:10.53,Default,,0000,0000,0000,,seen before. Right? So,
Dialogue: 0,0:22:10.53,0:22:18.75,Default,,0000,0000,0000,,done. Tick. Okay. Now, let's save it. Okay.
Dialogue: 0,0:22:18.75,0:22:21.69,Default,,0000,0000,0000,,So, totalsalary_v2. So, before we do
Dialogue: 0,0:22:21.69,0:22:27.03,Default,,0000,0000,0000,,that, let us run our macro. So, I'll
Dialogue: 0,0:22:27.03,0:22:31.67,Default,,0000,0000,0000,,just copy-paste that code portion here.
Dialogue: 0,0:22:31.67,0:22:35.85,Default,,0000,0000,0000,,Right. So, I'll just copy-paste this code
Dialogue: 0,0:22:35.85,0:22:37.88,Default,,0000,0000,0000,,portion here.
Dialogue: 0,0:22:37.88,0:22:41.19,Default,,0000,0000,0000,,It's mac_totalsalary_non--okay, I
Dialogue: 0,0:22:41.19,0:22:46.38,Default,,0000,0000,0000,,think my macro is totalsalary. It
Dialogue: 0,0:22:54.26,0:23:00.00,Default,,0000,0000,0000,,It has mismatched parenthesis. Okay. Okay. So,
Dialogue: 0,0:23:00.00,0:23:03.00,Default,,0000,0000,0000,,it has created this one. In this new
Dialogue: 0,0:23:03.00,0:23:06.33,Default,,0000,0000,0000,,field, in the new search field, what I'll
Dialogue: 0,0:23:06.33,0:23:09.51,Default,,0000,0000,0000,,do is--after this one--
Dialogue: 0,0:23:09.51,0:23:14.46,Default,,0000,0000,0000,,I'll be calling my totalsalary_v2 macro.
Dialogue: 0,0:23:14.46,0:23:16.02,Default,,0000,0000,0000,,Okay? Where it is doing
Dialogue: 0,0:23:16.02,0:23:18.48,Default,,0000,0000,0000,,the work of both of these two--bonus and
Dialogue: 0,0:23:18.48,0:23:22.15,Default,,0000,0000,0000,,totalsalary. Right? So, totalsalary_v2.
Dialogue: 0,0:23:22.15,0:23:27.72,Default,,0000,0000,0000,,Okay. So, my tick--v2. v2
Dialogue: 0,0:23:27.72,0:23:29.58,Default,,0000,0000,0000,,requires three arguments. One
Dialogue: 0,0:23:29.58,0:23:32.22,Default,,0000,0000,0000,,is my basic_salary, variable_percent, and
Dialogue: 0,0:23:32.22,0:23:35.04,Default,,0000,0000,0000,,the similar percent value--I'll give 8
Dialogue: 0,0:23:35.04,0:23:36.93,Default,,0000,0000,0000,,so that we can at least compare
Dialogue: 0,0:23:36.93,0:23:41.34,Default,,0000,0000,0000,,the outputs. So, if I run this one--see--
Dialogue: 0,0:23:41.34,0:23:42.72,Default,,0000,0000,0000,,it is working in the same way,
Dialogue: 0,0:23:42.72,0:23:45.15,Default,,0000,0000,0000,,where it is getting this bonus field and
Dialogue: 0,0:23:45.15,0:23:46.86,Default,,0000,0000,0000,,totalsalary. And if you see, the output
Dialogue: 0,0:23:46.86,0:23:49.55,Default,,0000,0000,0000,,is same as well.
Dialogue: 0,0:23:49.55,0:23:53.70,Default,,0000,0000,0000,,$15.22. We have given 7 here. Okay.
Dialogue: 0,0:23:53.70,0:23:57.60,Default,,0000,0000,0000,,Let's run it with 7 only. So,
Dialogue: 0,0:23:57.60,0:24:01.77,Default,,0000,0000,0000,,if you see--15.22, 20.22, 17.10, 17 like this.
Dialogue: 0,0:24:01.77,0:24:05.61,Default,,0000,0000,0000,,Okay? So, this is how you can call a macro
Dialogue: 0,0:24:05.61,0:24:08.37,Default,,0000,0000,0000,,inside another macro as well. So, if you
Dialogue: 0,0:24:08.37,0:24:11.94,Default,,0000,0000,0000,,see here, by this structure, you
Dialogue: 0,0:24:11.94,0:24:14.85,Default,,0000,0000,0000,,can achieve a very complex structure as
Dialogue: 0,0:24:14.85,0:24:18.18,Default,,0000,0000,0000,,well--a complex structure which
Dialogue: 0,0:24:18.18,0:24:20.25,Default,,0000,0000,0000,,is basically a reusable component in
Dialogue: 0,0:24:20.25,0:24:24.21,Default,,0000,0000,0000,,Splunk search queries. Okay? So, this is what
Dialogue: 0,0:24:24.21,0:24:26.52,Default,,0000,0000,0000,,you need to know, basically, to deal with
Dialogue: 0,0:24:26.52,0:24:29.79,Default,,0000,0000,0000,,macros. And macros are very useful in
Dialogue: 0,0:24:29.79,0:24:32.76,Default,,0000,0000,0000,,Splunk because not only do they give
Dialogue: 0,0:24:32.76,0:24:36.24,Default,,0000,0000,0000,,you the modularity approach, but also
Dialogue: 0,0:24:36.24,0:24:38.82,Default,,0000,0000,0000,,they give you a very short
Dialogue: 0,0:24:38.82,0:24:41.63,Default,,0000,0000,0000,,search string and very readable code as well.
Dialogue: 0,0:24:41.63,0:24:43.70,Default,,0000,0000,0000,,Okay? See you in the next video.