https://community.splunk.com/t5/Getting-Data-In/How-to-find-a-seach-file/m-p/678659#M113411 <P>From the syntax `Exempted_Dark_Devices`, it's a macro.</P><P>Look in the macro definitions and you should be able to find the expansion of this macro</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros</A></P> Mon, 26 Feb 2024 12:14:55 GMT renjith_nair 2024-02-26T12:14:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-a-seach-file/m-p/678657#M113410 <P>I have inherited a Splunk system and this is one of the alerts</P> <LI-CODE lang="markup">| metadata index=index-cc* type=hosts | eval age = now()-lastTime | where age &gt; 86400 | sort age d | convert ctime(lastTime) | fields lastTime,host,source,age | rename age as "Seconds Since Last Event" | search `Exempted_Dark_Devices`</LI-CODE> <P>&nbsp;</P> <P>How do I find the file Exempted_Dark_Devices?</P> <P>&nbsp;</P> <P>Thank you</P> Mon, 26 Feb 2024 13:05:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-a-seach-file/m-p/678657#M113410 mwcentracomm 2024-02-26T13:05:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-a-seach-file/m-p/678659#M113411 <P>From the syntax `Exempted_Dark_Devices`, it's a macro.</P><P>Look in the macro definitions and you should be able to find the expansion of this macro</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros</A></P> Mon, 26 Feb 2024 12:14:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-a-seach-file/m-p/678659#M113411 renjith_nair 2024-02-26T12:14:55Z