Splunk Search

Is there a way to find out the location of a given macro in a search head clustering environment?

Thuan
Explorer

I am new to a search head clustering environment. I found macros being used and I am trying to find out where these macros were created. I read the link http://docs.splunk.com/Documentation/ES/3.3.0/Install/Macros which has a lot of useful information on ES defined macros. Is there a way to quickly find out the location of a given macro, e.g.,

| `host_eventcount(30,72)`

using grep at the CLI, or search? This helps me to understand what canned searches do.

Thank you.

0 Karma

Thuan
Explorer

I will try the btool option as this is the answer I am looking for. It provides a unique way to look for macros. The other GUI option is too clumsy as you need to know what apps the macro was created for.

Thank you.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

One way to look up information about a given macro, is to use btool:

./splunk btool macros list host_eventcount --debug

Have you tried just looking for it in Settings > Advanced Search > Macros and looking across all owners / apps ?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!