Simplifying Splunk searches with macros
Macros are chunks of SPL that can be inserted into a Splunk search. These chunks do not have to be entire commands. Think of these macros as placeholders for SPL. So far, we have started all our searches with the following key/value pairs referencing the index and sourcetype properties that we intend to search:
index=botsv1 sourcetype=<sourcetype_name>
Let’s create a macro that we can use instead of typing these two key/value pairs every time.
Navigate to Settings | Advanced Search | Search Macros | Add New and enter the following values:
- Destination app: search
- Name: bots_st(1)
- Definition: index=botsv1 sourcetype=$st$
- Arguments: st
Then, click Save (see Figure 5.39):
Figure 5.39 – Creating a search macro called bots_st(1)
Let’s test our new search macro by typing the following in the search bar:
`bots_st("wineventlog")` user=Administrator...