Implementing Splunk 7, Third Edition - Third Edition

Using macros to reuse logic

A macro serves the purpose of replacing bits of search language with expanded phrases (additionally, macros have other uses, such as assisting in workflow creation).

Using macros can help you reuse logic and greatly reduce the length of queries.

Let's use the following as our example case:

sourcetype="impl_splunk_gen_SomeMoreLogs" user=mary 
| transaction maxpause=5m user 
| stats avg(duration) avg(eventcount)