Knowledge Management

List of Macros

IRHM73
Motivator

Hi,

I wonder whether someone may be able to help me please.

Could someone tell me please, is it possible to create a query which produces a list of all the 'search macros'. I've tried to find the correct settings using a REST query, but I'm not sure whether I'm going down the correct path or not.

Many thanks and kind regards

Chris

1 Solution

msivill_splunk
Splunk Employee
Splunk Employee

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

View solution in original post

javiergn
Super Champion

Try this:

| rest splunk_server=local /servicesNS/-/-/admin/macros 
| table title, args, eai:acl.app, definition
0 Karma

javiergn
Super Champion

Didn't see the answer above so ignore mine as it's pretty much the same

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

Graham_Hanningt
Builder

Thank you!

I'm using your answer to perform searches such as:

| rest /servicesNS/-/-/admin/macros count=0 
| where 'eai:appName'="myapp" AND like(title, "some_macro_name_prefix_%")
| table title

Why? I'm researching how to create a multiselect dropdown in a dashboard that lists macros whose names begin with a certain prefix, and then appends the selected macro(s) to the dashboard search. This is a relatively easy way to enable users to specify "custom" filters that are not directly, or not easily, supported by existing UI controls. I already include a text box for users to add their own SPL snippets to the text, so users could already "manually" refer to macros; a dropdown is friendlier.

0 Karma

mschaaf
Path Finder

Where is /admin/macros documented? I couldn't find it within the REST API Reference Manual.

IRHM73
Motivator

Hi @msivill, that's brilliant.

Thank you very much.

Kind Regards

Chris

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...