I have a macro and further it has multiple macros inside it.
So when the macro is ran and when i check the job inspector to see the contents of macro, it is not showing full content of macro instead it is showing some content and skipping 23145 lines in between.(may be because macro has macro inside it).
So how can i check the full content of macro when it ran(even it has other macros inside it)?
I am using splunk 6.5.1
After the search has run, tap
Expand macros. If there are any nested macros inside of macros, run that expanded search and do the same thing, deeper and deeper. This is only in v6.????
Have you tried opening up the Search Preview:
Use the keyboard shortcut Command-Shift-E (Mac OSX) or Control-Shift-E (Linux or Windows) to open the search preview.
It should let you view the contents of a macro, though, I am not sure if it will expand on any nested macros.
i had only one macro which has long query inside it, due to this, i was facing "Request URI too long error", hence i have used another macro inside a macro, to reduce the query length. But now i cannot able to see the expanded query when the macro has ran. In job inspector some lines are skipped.
now how to see whole expanded query when the macro has run in splunk 6.5.1?