https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411282#M3620 <P>What you describe sounds like a macro. <A href="https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Usesearchmacros">https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Usesearchmacros</A></P> Fri, 17 Aug 2018 12:14:40 GMT Ayn 2018-08-17T12:14:40Z https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411279#M3617 <P>Hi </P> <P>I need to create a search template using Splunk so I want to know what are the steps that I have to follow? must I create an app? are there any easy ways without using XML?</P> Fri, 17 Aug 2018 09:12:40 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411279#M3617 neermine 2018-08-17T09:12:40Z https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411280#M3618 <P>What do you mean by a "search template"? What do you plan to do with it?</P> Fri, 17 Aug 2018 11:11:54 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411280#M3618 richgalloway 2018-08-17T11:11:54Z https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411281#M3619 <P>it's simple i have this command "..|table date time app ipsrc ipdst..... " i want to create a temple that make me use it without writing it over and over again with every file that i open with splunk </P> Fri, 17 Aug 2018 11:31:17 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411281#M3619 neermine 2018-08-17T11:31:17Z https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411282#M3620 <P>What you describe sounds like a macro. <A href="https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Usesearchmacros">https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Usesearchmacros</A></P> Fri, 17 Aug 2018 12:14:40 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411282#M3620 Ayn 2018-08-17T12:14:40Z https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411283#M3621 <P>That would be a macro. Search macros are parameterized chunks of a search that you can reuse in saved and ad-hoc searches. Search macros can be any part of a search, such as an eval statement or search term, and do not need to be a complete command. You can also specify whether or not the macro field takes any arguments.</P> <P>Go to Settings-&gt;Advanced Search-&gt;Search macros-&gt;New to create a macro.<BR /> Invoke the macro in your search by enclosing the name in backticks.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Usesearchmacros?r=searchtip">Create and use search macros</A> - from the Splunk documentation</P> Fri, 17 Aug 2018 12:19:47 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411283#M3621 richgalloway 2018-08-17T12:19:47Z https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411284#M3622 <P>thank you <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Fri, 17 Aug 2018 13:08:49 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-create-a-search-template-macro-using-Splunk/m-p/411284#M3622 neermine 2018-08-17T13:08:49Z