All Apps and Add-ons

How to modify macros.conf to include multiple indexes

cisaksen
Explorer

How do I modify marcos.conf to include multiple indexes ? Will it recognize wildcards in the index name?

example:

   [event_sources]
    definition = (index="win*" OR source=*WinEventLog*)
    disabled = 0

cisaksen
Explorer

Thanks for the reply, but i found that the above syntax is actually working there are other issues as to why i'm not seeing what I think I should be.

Thanks again

0 Karma

manjunathmeti
Champion

Yes, search macros can include base search terms. It will recognize wildcards in index name.

From Splunk documentation:
Search macros are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command. You can also specify whether the macro field takes any arguments.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...