Splunk Enterprise

Splunk Macro

verifi81
Path Finder

I have this SPL

index="_internal" fwdType=uf | dedup hostname | table hostname

I want to create a macro called uf 

I have the macro created like this:

verifi81_0-1628816488766.png

 

I want to be able to just execute this macro in search but it doesn't look the same as if I execute the full command.

verifi81_1-1628816553225.png

 

What am I doing wrong?

 

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @verifi81 

You mean its not working, the macro shall be as this , what you are using is single quote that doesn't work. 

`uf`

  

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @verifi81 

You mean its not working, the macro shall be as this , what you are using is single quote that doesn't work. 

`uf`

  

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...