How to create Macros based on field list?

[SplunkExplorer]

Hi Splunkers, I'm trying to send one Splunk Cloud instance alerts to a Cortex XSOAR one.
The guide I'm following is the following one: Splunk py for NON ES users. Due we have not Enterprise Security, I must follow steps described in section Splunk non-Enterprise Security Users. 

Following this guide, what makes me a bit confused is step 4; they states only to create a macro to capture fields saved on a local file, but no indication on how to achieve this. I mean: I know I can put in macro code I want to reuse in more alerts, for example reuse the same where conditions in multiple different rules, but how should be the syntax to achieve what the guide states?

For example, if following step 2 and 3 I got the following field list:

list(field)
Blade,
ReachedPorts,
count,
dst_ip,
earliest_timestamp,
latest_timestamp,
src_ip,
src_user,
total_dst_port,

what code should I put on macro to "capture" them? Should I simply put fields list in macro code?

 

[bowesmana]

Those instructions are somewhat strange - the save to a local file seems a bit redundant and I'm not sure I understand the purpose of creating a macro with the table statement and the field list - unless you're going to re-use that macro in other places.

It seems like all they have done is Settings->Advanced Search->Macros and created a new macro with 

table list_of_field_names

so, it seems like all it is telling you is to make a table command with the wanted fields in the macro. 

Don't prefix it with the | symbol, so you can do

| `my_macro`

but I guess it's up to you if you feel you need a macro in the first place.

[SplunkExplorer]

I share your own doubts.

Thanks for answer, I will try; may be I found an alternative way, so your help is enough for now.

[SplunkExplorer]

Hi Slunkers, anyone able to help me on this issue?