Archive

How to expand macro inside a macro

Explorer

Hello,

I have a macro and further it has multiple macros inside it.

So when the macro is ran and when i check the job inspector to see the contents of macro, it is not showing full content of macro instead it is showing some content and skipping 23145 lines in between.(may be because macro has macro inside it).

So how can i check the full content of macro when it ran(even it has other macros inside it)?

I am using splunk 6.5.1

Thanks,
Chinmay.

Tags (1)
0 Karma

Path Finder

its shift+windows+E

0 Karma

Esteemed Legend

After the search has run, tap SHIFT-CTL-E to Expand macros. If there are any nested macros inside of macros, run that expanded search and do the same thing, deeper and deeper. This is only in v6.????

0 Karma

Explorer

i am using splunk version 6.5.1, this option does not work. Do you know any other alternative?

0 Karma

Esteemed Legend

Use this as an excuse to upgrade.

0 Karma

Splunk Employee
Splunk Employee

Have you tried opening up the Search Preview:

Use the keyboard shortcut Command-Shift-E (Mac OSX) or Control-Shift-E (Linux or Windows) to open the search preview.

It should let you view the contents of a macro, though, I am not sure if it will expand on any nested macros.

0 Karma

Explorer

i am using splunk version 6.5.1, this option does not work. Do you know any other alternative?

0 Karma

Splunk Employee
Splunk Employee

I just verified that this will expand out nested macros as well.

0 Karma

SplunkTrust
SplunkTrust

Why are you nesting macros inside of macros?

0 Karma

Explorer

i had only one macro which has long query inside it, due to this, i was facing "Request URI too long error", hence i have used another macro inside a macro, to reduce the query length. But now i cannot able to see the expanded query when the macro has ran. In job inspector some lines are skipped.

now how to see whole expanded query when the macro has run in splunk 6.5.1?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!