Extending Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 152

Creating a simple macro
Let's take the last two lines of our query and convert them to a macro. First, navigate to
Manager | Advanced search | Advanced search | Search macros and click on New .
Walking through our fields, we have:
• Destination app : This is where the macro will live.
• Name : This is the name we will use in our searches.
• Definition : This is the text that will be placed in our search.
• Use eval-based definition?: : If checked, the Definition string is treated
as an eval statement instead of raw text. We'll use this option later.
• The remaining fields are used if arguments are specified. We will use
these in our next example.