List of Macros

[IRHM73]

Hi,

I wonder whether someone may be able to help me please.

Could someone tell me please, is it possible to create a query which produces a list of all the 'search macros'. I've tried to find the correct settings using a REST query, but I'm not sure whether I'm going down the correct path or not.

Many thanks and kind regards

Chris

[javiergn]

Try this:

| rest splunk_server=local /servicesNS/-/-/admin/macros 
| table title, args, eai:acl.app, definition

[javiergn]

Didn't see the answer above so ignore mine as it's pretty much the same

[msivill_splunk · Accepted solution]

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

[Graham_Hanningt]

Thank you!

I'm using your answer to perform searches such as:

| rest /servicesNS/-/-/admin/macros count=0 
| where 'eai:appName'="myapp" AND like(title, "some_macro_name_prefix_%")
| table title

Why? I'm researching how to create a multiselect dropdown in a dashboard that lists macros whose names begin with a certain prefix, and then appends the selected macro(s) to the dashboard search. This is a relatively easy way to enable users to specify "custom" filters that are not directly, or not easily, supported by existing UI controls. I already include a text box for users to add their own SPL snippets to the text, so users could already "manually" refer to macros; a dropdown is friendlier.

[mschaaf]

Where is /admin/macros documented? I couldn't find it within the REST API Reference Manual.

[IRHM73]

Hi @msivill, that's brilliant.

Thank you very much.

Kind Regards

Chris