Creating a macro with arguments

Let's collapse the entire search into a macro that takes two arguments; the user and a value for maxpause:

Be sure to remove newlines from your search definition. Macros do not appear to work with embedded newlines.

Walking through our fields, we have the following:

  • Name: This is the name we will use in our searches. The parentheses and integer, (2), specify how many arguments this macro expects.
  • Definition: We have defined the entire query in this case. The variables are defined as $user$ and $maxpause$. We can use these names because we have defined the variables under Arguments.
  • Arguments: This list assigns ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.