What is the difference between eventtype and macro?

[jip31]

Hi

Even if i have read some documentations, i have difficulty to understand the difference between macro and eventtype

I use macro essentially for index + sourcetype agregation but is somebody can clearly explaining me the difference between macro and eventtype?

Thanks

[gcusello · Accepted solution]

Hi @jip31,

an eventtype is a search used to tag some events, in an eventtype you can put only the main search, in other words, you canot have pipes.

A macro is a part of code in which you can put many code statements (also with many pipes) with diferent following commands.

If you need only of a search e.g. with index and sourcetype), you can use both eventtype or macro, the main difference is that using a macro, you cannot associate a tag to your eventtype.

Ciao.

Giuseppe

[jip31]

Hi

Thanks its clear now

[gcusello]

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[ITWhisperer]

Macros are just text replacement and can be anything not just indexes/source types

[jip31]

Yes i know

I just said that actually i use macro for grouping index + sourcetype but i know i can use other fields

But i come back to my question

What is the difference with eventtype ?