How to Create a New Search Macro in Splunk

Step-by-Step Guide

1. 1

   Step 1: Go to your http://mysplunkhost:8000 in your web browser to access Splunk Web.

   Note: “mysplunkhost” in the URL should be replaced with the host you chose during installation.
   
   Upon installation you will also be provided with this URL.
2. 2

   Step 2: Log in using the username and password associated with your account.

   If it is your first time accessing the Splunk web interface, the default username is “admin” and the password is “changeme”.
   
   If it is your first time logging in, you may be prompted to create a new password. ,,,,, You can also optionally enter arguments, eval or boolean validation expression, and a validation error message. ,
3. 3

   Step 3: Click the “Manager” tab at the upper right of the screen.

4. 4

   Step 4: Click “Advanced search” from within the “Knowledge” pane.

5. 5

   Step 5: Click “Search macros”.

6. 6

   Step 6: Click the green “New” button to add a new search macro.

7. 7

   Step 7: Select a destination app from the drop down menu and enter a name and description for your macro.

8. 8

   Step 8: Click the “Save” button to complete the process of creating a new search macro.

Detailed Guide

About the Author