topic Re: Difference between and macro in Splunk Search

What is the difference between eventtype and macro?

jip31 — Wed, 26 Oct 2022 18:14:00 GMT

Even if i have read some documentations, i have difficulty to understand the difference between macro and eventtype

I use macro essentially for index + sourcetype agregation but is somebody can clearly explaining me the difference between macro and eventtype?

Thanks

Re: Difference between and macro

ITWhisperer — Wed, 26 Oct 2022 16:51:31 GMT

Macros are just text replacement and can be anything not just indexes/source types

Re: Difference between and macro

gcusello — Wed, 26 Oct 2022 16:56:35 GMT

Hi @jip31,

an eventtype is a search used to tag some events, in an eventtype you can put only the main search, in other words, you canot have pipes.

A macro is a part of code in which you can put many code statements (also with many pipes) with diferent following commands.

If you need only of a search e.g. with index and sourcetype), you can use both eventtype or macro, the main difference is that using a macro, you cannot associate a tag to your eventtype.

Ciao.

Giuseppe

Re: Difference between and macro

jip31 — Wed, 26 Oct 2022 16:57:07 GMT

Yes i know

I just said that actually i use macro for grouping index + sourcetype but i know i can use other fields

But i come back to my question

What is the difference with eventtype ?

Re: Difference between and macro

jip31 — Wed, 26 Oct 2022 17:36:17 GMT

Thanks its clear now

Re: Difference between and macro

gcusello — Thu, 27 Oct 2022 06:48:35 GMT

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉