https://community.splunk.com/t5/Splunk-Search/Search-by-macro-name/m-p/71962#M18000 <P>Not that I know of. Macros gets interpreted into the search string, and their original identity is pretty much lost. Depending on the complexity of your macro, you could build eventtypes that match it (or even replace it?). Eventtypes do retain their identity through the search and would let you do this.</P> Thu, 08 Sep 2011 16:42:34 GMT dwaddle 2011-09-08T16:42:34Z https://community.splunk.com/t5/Splunk-Search/Search-by-macro-name/m-p/71961#M17999 <P>Is there a way to count events by the name of the macros matched?</P> <P>Example, I have macros <CODE>A</CODE>, <CODE>B</CODE>, and <CODE>C</CODE>.</P> <P>Can I do a search of something equivalent to</P> <PRE><CODE>`A` OR `B` OR `C` | stats count(macro_name) </CODE></PRE> <P>?</P> Thu, 08 Sep 2011 16:34:00 GMT https://community.splunk.com/t5/Splunk-Search/Search-by-macro-name/m-p/71961#M17999 blurblebot 2011-09-08T16:34:00Z https://community.splunk.com/t5/Splunk-Search/Search-by-macro-name/m-p/71962#M18000 <P>Not that I know of. Macros gets interpreted into the search string, and their original identity is pretty much lost. Depending on the complexity of your macro, you could build eventtypes that match it (or even replace it?). Eventtypes do retain their identity through the search and would let you do this.</P> Thu, 08 Sep 2011 16:42:34 GMT https://community.splunk.com/t5/Splunk-Search/Search-by-macro-name/m-p/71962#M18000 dwaddle 2011-09-08T16:42:34Z