Splunk Enterprise

Why can't I find my search macros in Splunk Web using Splunk Light 6.4?

rnauman
Explorer

In the old Splunk under Settings -> Knowledge -> Advanced search, I could manage my macros. The 6.4 docs say Settings > Advanced Search > Search macros, but there is no advanced search, or I don't understand where settings are now. I clicked the left hamburger menu, but under Knowledge I only have

  • Searches, reports, and alerts
  • Event types
  • Tags
  • Fields

Help appreciated

0 Karma

gneumann_splunk
Splunk Employee
Splunk Employee

Hi rnauman,

The Splunk Light user interface does not have an "Advanced Search > Search macros" option in our current or previous releases.

I believe you are referencing the the Splunk Enterprise user interface, which has "Settings > Advanced Search > Search macros" and the Splunk Enterprise documentation, which has a section "Define search macros in Settings." See
http://docs.splunk.com/Documentation/Splunk/6.4.0/Knowledge/Definesearchmacros

Possibly you were using this feature in a Splunk Enterprise instance? I'm checking with our devs about this feature and using it in Splunk Light. Will post a follow-up when I have more information.

gneumann_splunk
Splunk Employee
Splunk Employee

I confirmed you can create macros outside the Splunk Light user interface using the macros.conf. See:
http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/macrosconf

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...