i constantly have to filter my search results based on a static list of known Windows service names. my searches usually end up looking like so
index="wineventlog" "Ordering" OR "Pricing" OR "Catalog" ....
What capability can i look up in Splunk to avoid having to append this long filter to every search that needs to only show events related to this static list of Windows services?
Hi,
you could build a macro for that:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Definesearchmacros
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesearchmacros
Kind regards
Please accept the answer, if it helped you.
Thank you
Hi,
you could build a macro for that:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Definesearchmacros
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesearchmacros
Kind regards