Why can't I find my search macros in Splunk Web using Splunk Light 6.4?

[rnauman]

In the old Splunk under Settings -> Knowledge -> Advanced search, I could manage my macros. The 6.4 docs say Settings > Advanced Search > Search macros, but there is no advanced search, or I don't understand where settings are now. I clicked the left hamburger menu, but under Knowledge I only have

• Searches, reports, and alerts
• Event types
• Tags
• Fields

Help appreciated

[gneumann_splunk]

Hi rnauman,

The Splunk Light user interface does not have an "Advanced Search > Search macros" option in our current or previous releases.

I believe you are referencing the the Splunk Enterprise user interface, which has "Settings > Advanced Search > Search macros" and the Splunk Enterprise documentation, which has a section "Define search macros in Settings." See
http://docs.splunk.com/Documentation/Splunk/6.4.0/Knowledge/Definesearchmacros

Possibly you were using this feature in a Splunk Enterprise instance? I'm checking with our devs about this feature and using it in Splunk Light. Will post a follow-up when I have more information.

[gneumann_splunk]

I confirmed you can create macros outside the Splunk Light user interface using the macros.conf. See:
http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/macrosconf