Splunk Macro

[verifi81]

I have this SPL

index="_internal" fwdType=uf | dedup hostname | table hostname

I want to create a macro called uf 

I have the macro created like this:

verifi81_0-1628816488766.png

I want to be able to just execute this macro in search but it doesn't look the same as if I execute the full command.

verifi81_1-1628816553225.png

What am I doing wrong?

[venkatasri · Accepted solution]

Hi @verifi81 

You mean its not working, the macro shall be as this , what you are using is single quote that doesn't work. 

`uf`