Building for the Splunk Platform

How to expand macros in search using Splunk Python SDK?

mikesmyk
New Member

Is there a way to expand all macros of a search with the python SDK?
In the end we want to have the whole search text in a python variable to modify it.

So far our solution is to get the search text using the splunk SDK and then search for macros and replace them with the definition of the macro, which we have to get separately with the SDK.
What we like to have is some function, that returns the search text with all macros expanded.

Is there something like this in the SDK which we did not found so far?

Splunk Enterprise Version: 6.6.4

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...