When you find yourself constantly reusing certain strings of Splunk commands, it can be a lot easier to represent those commands as a single line of code that can accept positional arguments and serve the same functions as a set of commands you find yourself using often.
To create a new macro, start on the search page and follow these steps: Select Settings > Advanced Search > Search macros Click New to create a search macro Follow the guidance in the macro creation page to finish your macro and save your work.
The macro creation menu in Splunk makes this very easy for you and provides examples for each field you need to fill out. Once you’ve saved your macro, you can make use of it again in a search by calling it between a pair of back tick characters ` ` followed by the positional arguments.