Splunk Search

How to expand macros in a Splunk search?

Builder

I have a search as follows:

index="x" search_name="`Y`" (status=Z) | `A` |`B`

where A and B are macros

Now how can I see the complete search by expanding all the Y, A, and B?

Also, if the macros (A and B) contain some internal macros and also some internal tags, how can I expand them all and see the complete search?

0 Karma
1 Solution

Champion

For versions Splunk 6.0 - 6.5, you need to open the job inspector for that search either in the Search app or via the job inspector / activity inspector. The job inspector will reveal how it interprets and expands the macros in order to execute the search.

Starting with Splunk 6.6, follow @hrottenberg_splunk instructions for the new macro expansion feature.

View solution in original post

Splunk Employee
Splunk Employee

New in 6.6, there is now a keystroke to expand macros in the search window! Click inside your search and press cmd-shift-E (on Mac) and ctrl-shift-E on Windows, and you'll see a window like this:

alt text

(Edit: corrected Windows hotkey, thanks for the comment below!)

Splunk Employee
Splunk Employee

Just an update. It is control + shift + E on windows.

Happy Splunking!

Super Champion

Navigate to Settings > Advanced Search > Search macros
There you can look for the definition of your macros.

https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Definesearchmacros

Path Finder

I downvoted this post because i'm really tired of karma-farming responses that are simply "rtfm" links. it degrades the value of all 'answers' activity if the only help anyone ever gets is a link back to documentation that seeker has already read. we've read the docs, and we're here for further clarification or perspective.

Super Champion

I downvoted this post because vise versa is true as well. many times users may not know the documentation page link.
on my answer, i have clearly replied the correct process and then for more clarity i have given the docs link. i don't see anything wrong with my answer.

Champion

For versions Splunk 6.0 - 6.5, you need to open the job inspector for that search either in the Search app or via the job inspector / activity inspector. The job inspector will reveal how it interprets and expands the macros in order to execute the search.

Starting with Splunk 6.6, follow @hrottenberg_splunk instructions for the new macro expansion feature.

View solution in original post

Splunk Employee
Splunk Employee

I downvoted this post because while it was very true, it's not true anymore though. see @hrottenberg comment below.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!