Getting Data In

How to find a seach file

mwcentracomm
Explorer

I have inherited a Splunk system and this is one of the alerts

| metadata index=index-cc* type=hosts | eval age = now()-lastTime | where age > 86400 | sort age d | convert ctime(lastTime) | fields lastTime,host,source,age | rename age as "Seconds Since Last Event" | search `Exempted_Dark_Devices`

 

How do I find the file Exempted_Dark_Devices?

 

Thank you

Labels (1)
0 Karma

renjith_nair
Legend

From the syntax `Exempted_Dark_Devices`, it's a macro.

Look in the macro definitions and you should be able to find the expansion of this macro

https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...