Is it possible to create a macro to do this?

[metersk]

We use Splunk as our A/B platform. Our test buckets are called "studies", and within each study we have "groups", which are the different A/B tests.

Anytime we want to query a study to compare results across all the groups within the study we have to create a query like the following:

msg=single_message reply=1 plat=2 OR plat=0 | extract kvdelim="=" limit=200 pairdelim="," | makemv delim="," studies | chart count by studies,is_p | rex field=studies "(?.)---(?.)" | where study="lab"

The bolded text above is what is required to break out a study by its groups. Is there any way to turn this into a macro, with the caveat that within where study="lab" where "lab" and "chart count by studies,is_p" can be changed to anything (because we have multiple studies)?

[lguinn2 · Accepted solution]

If all of the events are the same sourcetype, you could do this in props.conf and transforms.conf, and not have to put it into your searches at all...

Assume the sourcetype name is "study":

props.conf

[study]
KV_MODE=auto
REPORT-study1=extract-study-fields

transforms.conf

[extract-study-fields]
MV_ADD = true
DELIMS = ",", "="
FORMAT = $1::$2

I think this may be all you need. Your search would then be

msg=single_message reply=1 plat=2 OR plat=0 
| chart count by studies,is_p  
| where isnotnull(mvfind(studies,"lab"))