Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- how to add a timeformat for a search which contain...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a search as follows
earliest="08/01/2016:00:00:01" latest="08/01/2016:23:59:59" getABCsWin("XYZ","abc12345678")
Now how can I add the time format string as mentioned below for all the searches contains unique search string "getABCsWin"
timeformat="%d/%m/%Y:%H:%M:%S”
Is it something I need to add in macros.conf if yes. How can I add it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can edit the getABCsWin macro from the GUI. All (permissions) macros can be found at Settings > Advanced Search > Search macros.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can edit the getABCsWin macro from the GUI. All (permissions) macros can be found at Settings > Advanced Search > Search macros.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so in search macros do I need click new and add the macro?
Can you explain a little detail? I would really appreciate your help?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like the macro already exists. When you click on "Search Macros", it will list all the macros. Find the one called getABCsWin edit the definition & save.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to create a new macro for this scenario..
https://answers.splunk.com/answers/451935/how-to-create-a-macro-for-the-below-scenario.html?minQuest...
Prove Your Splunk Prowess at .conf25—No Prereqs Required!
Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code
Splunk Answers Content Calendar, July Edition I
