I have a search that returns all of my correlation searches for a given app.
| rest splunk_server=local count=0 /services/saved/searches
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")
| rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain
| search app=my_app
| table csearch_name, csearch_label, app, security_domain, qualifiedSearch, description
This works fine and gives the desired output. However, I would like to add a line in there that would automatically expand any macros in the qualifiedSearch field.
e.g.
search `azuread` "body.operationName"="Add member to role"
but return: search sourcetype=mscs:azure:eventhub "body.operationName"="Add member to role"
Is there a lookup or macroExpand function that I could add to my SPL to do this?
... View more