i constantly have to filter my search results based on a static list of known Windows service names. my searches usually end up looking like so
index="wineventlog" "Ordering" OR "Pricing" OR "Catalog" ....
What capability can i look up in Splunk to avoid having to append this long filter to every search that needs to only show events related to this static list of Windows services?
you could build a macro for that:
View solution in original post
Please accept the answer, if it helped you.