How to modify macros.conf to include multiple indexes

[cisaksen]

How do I modify marcos.conf to include multiple indexes ? Will it recognize wildcards in the index name?

example:

   [event_sources]
    definition = (index="win*" OR source=*WinEventLog*)
    disabled = 0

[cisaksen]

Thanks for the reply, but i found that the above syntax is actually working there are other issues as to why i'm not seeing what I think I should be.

Thanks again

[manjunathmeti]

Yes, search macros can include base search terms. It will recognize wildcards in index name.

From Splunk documentation:
Search macros are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command. You can also specify whether the macro field takes any arguments.