Splunk Enterprise

Why can't I find my search macros in Splunk Web using Splunk Light 6.4?

rnauman
Explorer

In the old Splunk under Settings -> Knowledge -> Advanced search, I could manage my macros. The 6.4 docs say Settings > Advanced Search > Search macros, but there is no advanced search, or I don't understand where settings are now. I clicked the left hamburger menu, but under Knowledge I only have

  • Searches, reports, and alerts
  • Event types
  • Tags
  • Fields

Help appreciated

0 Karma

gneumann_splunk
Splunk Employee
Splunk Employee

Hi rnauman,

The Splunk Light user interface does not have an "Advanced Search > Search macros" option in our current or previous releases.

I believe you are referencing the the Splunk Enterprise user interface, which has "Settings > Advanced Search > Search macros" and the Splunk Enterprise documentation, which has a section "Define search macros in Settings." See
http://docs.splunk.com/Documentation/Splunk/6.4.0/Knowledge/Definesearchmacros

Possibly you were using this feature in a Splunk Enterprise instance? I'm checking with our devs about this feature and using it in Splunk Light. Will post a follow-up when I have more information.

gneumann_splunk
Splunk Employee
Splunk Employee

I confirmed you can create macros outside the Splunk Light user interface using the macros.conf. See:
http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/macrosconf

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!