Implementing Splunk 7, Third Edition - Third Edition

Creating a macro with arguments

Let's collapse the entire search into a macro that takes two arguments; the user and a value for maxpause:

Be sure to remove newlines from your search definition. Macros do not appear to work with embedded newlines.

Walking through our fields, we have the following:

• Name: This is the name we will use in our searches. The parentheses and integer, (2), specify how many arguments this macro expects.
• Definition: We have defined the entire query in this case. The variables are defined as $user$ and $maxpause$. We can use these names because we have defined the variables under Arguments.
• Arguments: This list assigns ...