I have this SPL
index="_internal" fwdType=uf | dedup hostname | table hostname
I want to create a macro called uf
I have the macro created like this:
I want to be able to just execute this macro in search but it doesn't look the same as if I execute the full command.
What am I doing wrong?
You mean its not working, the macro shall be as this , what you are using is single quote that doesn't work.
View solution in original post