Design macro searches
To simplify managing your searches, you can create saved searches that include macros, which are parametrized chunks of a search. These search macros can be any part of a search, such as an eval statement or search term, and do not need to be a complete command. With macros, you can reuse chunks of a search in multiple places, whether its a saved search or an ad hoc search. You can also specify whether or not the search macros take any or no arguments.
Note: Form searches also use search macros, but include a graphical user interface component.
Configure and manage search macros
You can view, edit, and create search macros using Splunk Web's Manager > Advanced Search > Search macros page and
macros.conf. For more information, see "Create and use search macros" in the Search Manual and the macros.conf reference in the Admin Manual.
Manage search jobs from the operating system
Design form searches
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18