All Apps and Add-ons

How to modify macros.conf to include multiple indexes

cisaksen
Explorer

How do I modify marcos.conf to include multiple indexes ? Will it recognize wildcards in the index name?

example:

   [event_sources]
    definition = (index="win*" OR source=*WinEventLog*)
    disabled = 0

cisaksen
Explorer

Thanks for the reply, but i found that the above syntax is actually working there are other issues as to why i'm not seeing what I think I should be.

Thanks again

0 Karma

manjunathmeti
Champion

Yes, search macros can include base search terms. It will recognize wildcards in index name.

From Splunk documentation:
Search macros are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command. You can also specify whether the macro field takes any arguments.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...