Is there a way to find out the location of a given macro in a search head clustering environment?

[Thuan]

I am new to a search head clustering environment. I found macros being used and I am trying to find out where these macros were created. I read the link http://docs.splunk.com/Documentation/ES/3.3.0/Install/Macros which has a lot of useful information on ES defined macros. Is there a way to quickly find out the location of a given macro, e.g.,

| `host_eventcount(30,72)`

using grep at the CLI, or search? This helps me to understand what canned searches do.

Thank you.

[Thuan]

I will try the btool option as this is the answer I am looking for. It provides a unique way to look for macros. The other GUI option is too clumsy as you need to know what apps the macro was created for.

Thank you.

[aljohnson_splun]

One way to look up information about a given macro, is to use btool:

./splunk btool macros list host_eventcount --debug

Have you tried just looking for it in Settings > Advanced Search > Macros and looking across all owners / apps ?