Looking to create macros without parameters in splunk? We have come with another interesting topic in Splunk, Today we are going to discuss about how to create macros without parameters in splunk.
What is macro?
Search Macro can be defined as a full SPL query or a chunk of a query which can be reused in another query or can be used as single. Search Macro can be any part of a query such as any command, eval functions etc.
Search Macro Without Argument – Normal SPL query or a chunk of a query.
Creating macro for splunk
Step1: Go to setting>advanced search>search macro
Step1: Create search 1st
index="_internal" sourcetype=splunkd_ui_access|stats count by method
Now search for the macro created in it.
You can see the Expanded Search String by clicking Control + Shift + E ( For windows and linux system)
Step 2. You can save the chunk of spl as macro
Here in this Spl we have used the chunk for search and used the macro in that search.
index="_internal" sourcetype=splunkd_ui_access chunkmacro
This how we can create simple macro in the search.