search macro

noun

A parameterized portion of a search--such as an eval statement or a search term--that can be reused in multiple places, including saved and ad hoc searches, and which is used in a manner similar to a search command. Search macros can contain arguments, but they are not required.

When you include a search macro in a saved or ad hoc search, you use a left quote (also known as a grave accent) to reference it. For example, here is a search using a search macro titled pageviews_per_second:

`pageviews_per_second`

You can also nest search macros within each other. The pageviews_per_second search macro referenced above could be made up of this search, which includes another search macro called makesessions:

eventtype=pageview | `makesessions` | timechart span=1d sum(eventcount) as pageviews count as sessions

For more information

In the User Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time