Archive

How to create a macro for the below scenario?

Builder

I have a search as follows

earliest="08/01/2016:00:00:01" latest="08/01/2016:23:59:59" getABCsWin("XYZ","abc12345678")

Now how can I add the time format string as mentioned below for all the searches contains unique search string "getABCsWin"

timeformat="%d/%m/%Y:%H:%M:%S”

What condition and search string etc should I have to use for creating a macro?

0 Karma
1 Solution

Builder
0 Karma

Builder
0 Karma

Legend

What would you like the macro to do? Can you share some examples?

0 Karma

Builder

when any splunk search runs with the word "getABCsWin"(in any dashboard or alert etc etc). I want the string timeformat="%d/%m/%Y:%H:%M:%S” to be added to that search. So that i can get the output as i needed i.e; in the DD/MM/YYYY format.

0 Karma