Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Design macro searches

To simplify managing your searches, you can create saved searches that include macros, which are parametrized chunks of a search. These search macros can be any part of a search, such as an eval statement or search term, and do not need to be a complete command. With macros, you can reuse chunks of a search in multiple places, whether its a saved search or an ad hoc search. You can also specify whether or not the search macros take any or no arguments.

Note: Form searches also use search macros, but include a graphical user interface component.

Configure and manage search macros

You can view, edit, and create search macros using Splunk Web's Manager > Advanced Search > Search macros page and macros.conf. For more information, see "Create and use search macros" in the Search Manual and the macros.conf reference in the Admin Manual.

Manage search jobs from the operating system
Design form searches

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters