Using macros to reuse logic

A macro serves the purpose of replacing bits of search language with expanded phrases (additionally, macros have other uses, such as assisting in workflow creation).

Using macros can help you reuse logic and greatly reduce the length of queries.

Let's use the following as our example case:

sourcetype="impl_splunk_gen_SomeMoreLogs" user=mary 
| transaction maxpause=5m user 
| stats avg(duration) avg(eventcount) 

Creating a simple macro

Let's take the last two lines of our query and convert them to a macro. First, navigate to Settings | Advanced search | Search macros and click on New:

Walking through our fields, we have the following:

• Destination app: This is where the macro will live.
• Name: This is the name we will use in our searches.
• Definition: This is the text that will be placed in our search.
• Use eval-based definition?: If checked, the Definition string is treated as an eval statement instead of the raw text. We'll use this option later.

The remaining fields are used...