https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Macro/m-p/563131#M9699 <P>I have this SPL</P><P><STRONG>index="_internal" fwdType=uf | dedup hostname | table hostname</STRONG></P><P>I want to create a macro called <STRONG>uf&nbsp;</STRONG></P><P>I have the macro created like this:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="verifi81_0-1628816488766.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15553i3F98601180AFAA17/image-size/medium?v=v2&amp;px=400" role="button" title="verifi81_0-1628816488766.png" alt="verifi81_0-1628816488766.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">verifi81_0-1628816488766.png</span></span></P><P>&nbsp;</P><P>I want to be able to just execute this macro in search but it doesn't look the same as if I execute the full command.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="verifi81_1-1628816553225.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15554i4319E8C463764406/image-size/medium?v=v2&amp;px=400" role="button" title="verifi81_1-1628816553225.png" alt="verifi81_1-1628816553225.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">verifi81_1-1628816553225.png</span></span></P><P>&nbsp;</P><P>What am I doing wrong?</P><P>&nbsp;</P> Fri, 13 Aug 2021 01:02:48 GMT verifi81 2021-08-13T01:02:48Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Macro/m-p/563131#M9699 <P>I have this SPL</P><P><STRONG>index="_internal" fwdType=uf | dedup hostname | table hostname</STRONG></P><P>I want to create a macro called <STRONG>uf&nbsp;</STRONG></P><P>I have the macro created like this:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="verifi81_0-1628816488766.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15553i3F98601180AFAA17/image-size/medium?v=v2&amp;px=400" role="button" title="verifi81_0-1628816488766.png" alt="verifi81_0-1628816488766.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">verifi81_0-1628816488766.png</span></span></P><P>&nbsp;</P><P>I want to be able to just execute this macro in search but it doesn't look the same as if I execute the full command.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="verifi81_1-1628816553225.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15554i4319E8C463764406/image-size/medium?v=v2&amp;px=400" role="button" title="verifi81_1-1628816553225.png" alt="verifi81_1-1628816553225.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">verifi81_1-1628816553225.png</span></span></P><P>&nbsp;</P><P>What am I doing wrong?</P><P>&nbsp;</P> Fri, 13 Aug 2021 01:02:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Macro/m-p/563131#M9699 verifi81 2021-08-13T01:02:48Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Macro/m-p/563132#M9700 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/222747">@verifi81</a>&nbsp;</P><P>You mean its not working, the macro shall be as this , what you are using is single quote that doesn't work.&nbsp;</P><LI-CODE lang="markup">`uf`</LI-CODE><P>&nbsp;&nbsp;</P> Fri, 13 Aug 2021 01:29:29 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Macro/m-p/563132#M9700 venkatasri 2021-08-13T01:29:29Z