Knowledge Management

List of Macros

IRHM73
Motivator

Hi,

I wonder whether someone may be able to help me please.

Could someone tell me please, is it possible to create a query which produces a list of all the 'search macros'. I've tried to find the correct settings using a REST query, but I'm not sure whether I'm going down the correct path or not.

Many thanks and kind regards

Chris

1 Solution

msivill_splunk
Splunk Employee
Splunk Employee

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

View solution in original post

javiergn
Super Champion

Try this:

| rest splunk_server=local /servicesNS/-/-/admin/macros 
| table title, args, eai:acl.app, definition
0 Karma

javiergn
Super Champion

Didn't see the answer above so ignore mine as it's pretty much the same

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

Graham_Hanningt
Builder

Thank you!

I'm using your answer to perform searches such as:

| rest /servicesNS/-/-/admin/macros count=0 
| where 'eai:appName'="myapp" AND like(title, "some_macro_name_prefix_%")
| table title

Why? I'm researching how to create a multiselect dropdown in a dashboard that lists macros whose names begin with a certain prefix, and then appends the selected macro(s) to the dashboard search. This is a relatively easy way to enable users to specify "custom" filters that are not directly, or not easily, supported by existing UI controls. I already include a text box for users to add their own SPL snippets to the text, so users could already "manually" refer to macros; a dropdown is friendlier.

0 Karma

mschaaf
Path Finder

Where is /admin/macros documented? I couldn't find it within the REST API Reference Manual.

IRHM73
Motivator

Hi @msivill, that's brilliant.

Thank you very much.

Kind Regards

Chris

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...