Splunk Search

How to expand macros in a Splunk search?

pavanae
Builder

I have a search as follows:

index="x" search_name="`Y`" (status=Z) | `A` |`B`

where A and B are macros

Now how can I see the complete search by expanding all the Y, A, and B?

Also, if the macros (A and B) contain some internal macros and also some internal tags, how can I expand them all and see the complete search?

0 Karma
1 Solution

rjthibod
Champion

For versions Splunk 6.0 - 6.5, you need to open the job inspector for that search either in the Search app or via the job inspector / activity inspector. The job inspector will reveal how it interprets and expands the macros in order to execute the search.

Starting with Splunk 6.6, follow @hrottenberg_splunk instructions for the new macro expansion feature.

View solution in original post

hrottenberg_spl
Splunk Employee
Splunk Employee

New in 6.6, there is now a keystroke to expand macros in the search window! Click inside your search and press cmd-shift-E (on Mac) and ctrl-shift-E on Windows, and you'll see a window like this:

alt text

(Edit: corrected Windows hotkey, thanks for the comment below!)

yahuja_splunk
Splunk Employee
Splunk Employee

Just an update. It is control + shift + E on windows.

Happy Splunking!

inventsekar
Super Champion

Navigate to Settings > Advanced Search > Search macros
There you can look for the definition of your macros.

https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Definesearchmacros

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

anewell
Path Finder

I downvoted this post because i'm really tired of karma-farming responses that are simply "rtfm" links. it degrades the value of all 'answers' activity if the only help anyone ever gets is a link back to documentation that seeker has already read. we've read the docs, and we're here for further clarification or perspective.

inventsekar
Super Champion

I downvoted this post because vise versa is true as well. many times users may not know the documentation page link.
on my answer, i have clearly replied the correct process and then for more clarity i have given the docs link. i don't see anything wrong with my answer.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

rjthibod
Champion

For versions Splunk 6.0 - 6.5, you need to open the job inspector for that search either in the Search app or via the job inspector / activity inspector. The job inspector will reveal how it interprets and expands the macros in order to execute the search.

Starting with Splunk 6.6, follow @hrottenberg_splunk instructions for the new macro expansion feature.

David
Splunk Employee
Splunk Employee

I downvoted this post because while it was very true, it's not true anymore though. see @hrottenberg comment below.

Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...