Splunk Search

How do I query a macro for it's definition?

fdarrigo
Path Finder

I would like to query an app's macros and return the macro attributes such as the name and the definition. Can someone point me in the right direction?

Tags (3)

dcarmack_splunk
Splunk Employee
Splunk Employee
| rest /servicesNS/-/-/admin/macros splunk_server=local | search title=<name of macro> 

renjith_nair
Legend

Try

| rest services/configs/conf-macros|table definition args
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...