https://community.splunk.com/t5/Knowledge-Management/workflow-action-to-polpulate-macro/m-p/358668#M3053 <P>You would use the REST API to update a macro; here is an excellent answer on how to do that (be sure to UpVote him):<BR /> <A href="https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html">https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html</A></P> Tue, 08 Aug 2017 14:22:32 GMT woodcock 2017-08-08T14:22:32Z https://community.splunk.com/t5/Knowledge-Management/workflow-action-to-polpulate-macro/m-p/358667#M3052 <P>how to create a workflow action to populate a macro? Use a workflow action to grab hostname/IP from event and pass that to a macro for later use in follow on searches.</P> Tue, 08 Aug 2017 12:20:42 GMT https://community.splunk.com/t5/Knowledge-Management/workflow-action-to-polpulate-macro/m-p/358667#M3052 coreyf311 2017-08-08T12:20:42Z https://community.splunk.com/t5/Knowledge-Management/workflow-action-to-polpulate-macro/m-p/358668#M3053 <P>You would use the REST API to update a macro; here is an excellent answer on how to do that (be sure to UpVote him):<BR /> <A href="https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html">https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html</A></P> Tue, 08 Aug 2017 14:22:32 GMT https://community.splunk.com/t5/Knowledge-Management/workflow-action-to-polpulate-macro/m-p/358668#M3053 woodcock 2017-08-08T14:22:32Z