What does empty macro do?

[zksplunk]

Is there any difference between a empty macro with 

()

or

""

I see search with both both return results but do not behave the same as 

index=*

So what does these empty macro do actually? Any clues what logs or where I can further drill down this?

[yuanliu]

Maybe you can give more context?  Where are you using any of these?  If you cannot illustrate the real search command, at least post some mock code, or use index=_internal or something to demonstrate that the two are different?  What is an "empty macro", anyway?

[zksplunk]

Thank you for your quick response. I am literally asking what does searching with exactly a pair of parenthesis with nothing inside "()" do, as many Security Content searches include an empty macro for users to add whitelist/exceptions to their search. And by default these macros are empty. At first I thought they will do nothing, but when I put one such empty macro search, it actually returns with results. I am concern if these empty macro will mess up with my searches.

[isoutamo]

If/when you have those macros on your SPL, you could expand those and see real SPL by pressing “Ctrl+Shift+e” on Windows. Then you can run those and see how those are working.

[yuanliu]

First of all, you need to realize that () in SPL has nothing to do with "macro".  Like in most languages, it is just a syntax to isolate terms.  On their own, they do nothing.  You will have to illustrate the context where you see behavior difference.

Let me first show you two examples:

index = _internal earliest=-2h@h latest=-1h@h

and

index = _internal earliest=-2h@h latest=-1h@h ()

They give me the exact same result.