Macros for the Splunk App for AWS

The Splunk App for AWS includes a set of macros that support dashboard performance. In most circumstances, you do not need to edit these macros.

If you are on a distributed deployment of Splunk Enterprise and you are not using the remote target command and thus managing inputs from the Splunk Add-on for AWS rather than the app, you need to update the index macros on your search heads to include any custom indexes that you are using for your AWS data by running the Update Macros saved search.

Name	Default macro definition	Update required if you manage inputs from the add-on rather than the app
aws-cloudtrail-index	(index="main" OR index="aws-cloudtrail")	If you are using any index for your CloudTrail data other than main, aws-cloudtrail, or another default index you have set for your environment, add it to this definition.
aws-config-index	(index="main" OR index="aws-config")	If you are using any index for your Config data other than main, aws-config, or another default index you have set for your environment, add it to this definition.
aws-billing-index	(index="main" OR index="default")	If you are using any index for your Billing data other than main or another default index you have set for your environment, add it to this definition.
aws-cloudwatch-index	(index="main" OR index="default")	If you are using any index for your CloudWatch data other than main or another default index you have set for your environment, add it to this definition.
aws-description-index	(index="main" OR index="default")	If you are using any index for your Description data other than main, add it to this definition.
aws-config-rule-index	(index="main" OR index="default")	If you are using any index for your Config Rule data other than main, add it to this definition.
aws-inspector-index	(index="main" OR index="default")	If you are using any index for your Amazon Inspector data other than main, add it to this definition.
aws-s3-index	(index="main")	If you are using any indexes for your S3 access logs, ELB access logs, and CloudFront access logs other than main, add them to this definition.
aws-health-index	(index="main")	If you are using any index for your AWS Personal Health data other than main, add it to this definition.
aws-cloudwatch-logs-index	(index="main" OR index="default")	If you are using any indexes other than main for your CloudWatch Logs data, including any data that you collect through the add-on's Kinesis input, add it to this definition.

If you do not run the Update Macros saved search to automatically update the macros, you can manually edit these macros to add your custom indexes.

1. On each search head, go to Settings > Advanced search > Search macros.
2. Change the App context to Splunk App for AWS (splunk_app_aws).
3. Sort the list by Definition.
4. Look for the macros with definitions that start with (index=.
5. Open each macro and edit the definition string to include your custom indexes.

Alternatively, you can make these edits in $SPLUNK_HOME/etc/apps/splunk_app_aws/local/macros.conf on each search head.