Documentation > Splunk > Knowledge Manager Manual > Design macro searches

Knowledge Manager Manual

 


Welcome to knowledge management
Organize and administrate knowledge objects
Data interpretation: Fields and field extractions
Data classification: Event types and transactions
Data enrichment: Lookups and workflow actions
Data normalization: Tags and aliases
Manage your search knowledge
Set up and use summary indexes

Design macro searches

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Design macro searches

To simplify managing your searches, you can create saved searches that include macros, which are parametrized chunks of a search. These search macros can by any part of a search, such as an eval statement or search term, and do not need to be a complete command. With macros, you can reuse chunks of a search in multiple places, whether its a saved search or an ad hoc search. You can also specify whether or not the search macros take any or no arguments.

Note: Form searches also use search macros, but include a graphical user interface component.

Configure and manage search macros

You can view, edit, and create search macros using Splunk Web's Manager > Advanced Search > Search macros page and macros.conf. For more information, see "Create and use search macros" in the User Manual and the macros.conf reference in the Admin Manual.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Designmacrosearches"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!