How to expand macro inside a macro

[chinmayc469]

Hello,

I have a macro and further it has multiple macros inside it.

So when the macro is ran and when i check the job inspector to see the contents of macro, it is not showing full content of macro instead it is showing some content and skipping 23145 lines in between.(may be because macro has macro inside it).

So how can i check the full content of macro when it ran(even it has other macros inside it)?

I am using splunk 6.5.1

Thanks,
Chinmay.

[sivaranjiniG]

its shift+windows+E

[woodcock]

After the search has run, tap SHIFT-CTL-E to Expand macros. If there are any nested macros inside of macros, run that expanded search and do the same thing, deeper and deeper. This is only in v6.????

[chinmayc469]

i am using splunk version 6.5.1, this option does not work. Do you know any other alternative?

[woodcock]

Use this as an excuse to upgrade.

[kmorris_splunk]

Have you tried opening up the Search Preview:

Use the keyboard shortcut Command-Shift-E (Mac OSX) or Control-Shift-E (Linux or Windows) to open the search preview.

It should let you view the contents of a macro, though, I am not sure if it will expand on any nested macros.

[chinmayc469]

i am using splunk version 6.5.1, this option does not work. Do you know any other alternative?

[kmorris_splunk]

I just verified that this will expand out nested macros as well.

[skoelpin]

Why are you nesting macros inside of macros?

[chinmayc469]

i had only one macro which has long query inside it, due to this, i was facing "Request URI too long error", hence i have used another macro inside a macro, to reduce the query length. But now i cannot able to see the expanded query when the macro has ran. In job inspector some lines are skipped.

now how to see whole expanded query when the macro has run in splunk 6.5.1?