Splunk Enterprise
Highlighted

Why can't I find my search macros in Splunk Web using Splunk Light 6.4?

Explorer

In the old Splunk under Settings -> Knowledge -> Advanced search, I could manage my macros. The 6.4 docs say Settings > Advanced Search > Search macros, but there is no advanced search, or I don't understand where settings are now. I clicked the left hamburger menu, but under Knowledge I only have

  • Searches, reports, and alerts
  • Event types
  • Tags
  • Fields

Help appreciated

0 Karma
Highlighted

Re: Why can't I find my search macros in Splunk Web using Splunk Light 6.4?

Splunk Employee
Splunk Employee

Hi rnauman,

The Splunk Light user interface does not have an "Advanced Search > Search macros" option in our current or previous releases.

I believe you are referencing the the Splunk Enterprise user interface, which has "Settings > Advanced Search > Search macros" and the Splunk Enterprise documentation, which has a section "Define search macros in Settings." See
http://docs.splunk.com/Documentation/Splunk/6.4.0/Knowledge/Definesearchmacros

Possibly you were using this feature in a Splunk Enterprise instance? I'm checking with our devs about this feature and using it in Splunk Light. Will post a follow-up when I have more information.

Highlighted

Re: Why can't I find my search macros in Splunk Web using Splunk Light 6.4?

Splunk Employee
Splunk Employee

I confirmed you can create macros outside the Splunk Light user interface using the macros.conf. See:
http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/macrosconf

0 Karma