topic How to expand macro inside a macro in Knowledge Management

How to expand macro inside a macro

chinmayc469 — Thu, 12 Jul 2018 11:08:20 GMT

Hello,

I have a macro and further it has multiple macros inside it.

So when the macro is ran and when i check the job inspector to see the contents of macro, it is not showing full content of macro instead it is showing some content and skipping 23145 lines in between.(may be because macro has macro inside it).

So how can i check the full content of macro when it ran(even it has other macros inside it)?

I am using splunk 6.5.1

Thanks,
Chinmay.

Re: How to expand macro inside a macro

skoelpin — Thu, 12 Jul 2018 14:16:05 GMT

Why are you nesting macros inside of macros?

Re: How to expand macro inside a macro

kmorris_splunk — Thu, 12 Jul 2018 19:45:28 GMT

Have you tried opening up the Search Preview:

Use the keyboard shortcut Command-Shift-E (Mac OSX) or Control-Shift-E (Linux or Windows) to open the search preview.

It should let you view the contents of a macro, though, I am not sure if it will expand on any nested macros.

Re: How to expand macro inside a macro

kmorris_splunk — Thu, 12 Jul 2018 19:52:27 GMT

I just verified that this will expand out nested macros as well.

Re: How to expand macro inside a macro

woodcock — Thu, 12 Jul 2018 21:19:17 GMT

After the search has run, tap SHIFT-CTL-E to Expand macros. If there are any nested macros inside of macros, run that expanded search and do the same thing, deeper and deeper. This is only in v6.????

Re: How to expand macro inside a macro

chinmayc469 — Fri, 13 Jul 2018 05:08:28 GMT

i am using splunk version 6.5.1, this option does not work. Do you know any other alternative?

Re: How to expand macro inside a macro

chinmayc469 — Fri, 13 Jul 2018 05:08:51 GMT

i am using splunk version 6.5.1, this option does not work. Do you know any other alternative?

Re: How to expand macro inside a macro

chinmayc469 — Fri, 13 Jul 2018 12:32:50 GMT

i had only one macro which has long query inside it, due to this, i was facing "Request URI too long error", hence i have used another macro inside a macro, to reduce the query length. But now i cannot able to see the expanded query when the macro has ran. In job inspector some lines are skipped.

now how to see whole expanded query when the macro has run in splunk 6.5.1?

Re: How to expand macro inside a macro

woodcock — Fri, 13 Jul 2018 12:46:50 GMT

Use this as an excuse to upgrade.

Re: How to expand macro inside a macro

sivaranjiniG — Thu, 12 Sep 2019 11:32:20 GMT

its shift+windows+E