...he user for the desired index name.
But then, how do I get my saved search or view or dashboard to reference the value the user entered?
I created a macro in $app/etc/default/macros.conf, d...
...imeformat and getting the results as needed. So I need to get work on the macros instead of modifying the search since if modified the search display wrong results for outside US users.
What c...
...nd replacing, probably I can do using SPL itself. The script should just update macros.conf.
Another alternative is to write a shell script, but trying from Splunk before I go that route.
T...
I have created a macro within an app using the macros.conf file. I am able to see the macro within the Settings -> Advanced Search -> Search Macros if I look under the context of my app. T...
The subject has the entirety of my question but as a bonus to anyone who reads this, here is a macro that everyone should find useful (if you understand why this is useful, add that to your answer): ...
...he searches contains unique search string "getABCsWin"
timeformat="%d/%m/%Y:%H:%M:%S”
Is it something I need to add in macros.conf if yes. How can I add it?
I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.
What is the possible path to find the macros...
How do I modify marcos.conf to include multiple indexes ? Will it recognize wildcards in the index name?
example:
[event_sources]
definition = (index="win*" OR source=*W...
...acro 'get_index' in DA and then using this macro in each dashboard search inside DA. Inside TA, any time the user updates the index field, I call the macros REST endpoint to update the macros.conf in DA. A...