how to create a workflow action to populate a macro? Use a workflow action to grab hostname/IP from event and pass that to a macro for later use in follow on searches.
You would use the REST API to update a macro; here is an excellent answer on how to do that (be sure to UpVote him): https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html
View solution in original post
