A macro serves the purpose of replacing bits of search language with expanded phrases. Using macros can help you reuse logic and greatly reduce the length of queries.
Let's use one of our examples from Chapter 5, Advanced Search Examples, as our example case:
sourcetype="impl_splunk_web" user=mary | transaction maxpause=5m user | stats avg(duration) avg(eventcount)
Let's take the last two lines of our query and convert them to a macro. First, navigate to Manager | Advanced search | Advanced search | Search macros and click on New.
Walking through our fields, we have: