Knowledge Management

List of Macros

IRHM73
Motivator

Hi,

I wonder whether someone may be able to help me please.

Could someone tell me please, is it possible to create a query which produces a list of all the 'search macros'. I've tried to find the correct settings using a REST query, but I'm not sure whether I'm going down the correct path or not.

Many thanks and kind regards

Chris

1 Solution

msivill_splunk
Splunk Employee
Splunk Employee

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Try this:

| rest splunk_server=local /servicesNS/-/-/admin/macros 
| table title, args, eai:acl.app, definition
0 Karma

javiergn
SplunkTrust
SplunkTrust

Didn't see the answer above so ignore mine as it's pretty much the same

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Does this work for you?

| rest /servicesNS/-/-/admin/macros count=0 splunk_server=local

or the shorter

| rest /servicesNS/-/-/admin/macros count=0

Graham_Hanningt
Builder

Thank you!

I'm using your answer to perform searches such as:

| rest /servicesNS/-/-/admin/macros count=0 
| where 'eai:appName'="myapp" AND like(title, "some_macro_name_prefix_%")
| table title

Why? I'm researching how to create a multiselect dropdown in a dashboard that lists macros whose names begin with a certain prefix, and then appends the selected macro(s) to the dashboard search. This is a relatively easy way to enable users to specify "custom" filters that are not directly, or not easily, supported by existing UI controls. I already include a text box for users to add their own SPL snippets to the text, so users could already "manually" refer to macros; a dropdown is friendlier.

0 Karma

mschaaf
Path Finder

Where is /admin/macros documented? I couldn't find it within the REST API Reference Manual.

IRHM73
Motivator

Hi @msivill, that's brilliant.

Thank you very much.

Kind Regards

Chris

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...