Creating Macros for Code Reuse in Splunk

When you find yourself constantly reusing certain strings of Splunk commands, it can be a lot easier to represent those commands as a single line of code that can accept positional arguments and serve the same functions as a set of commands you find yourself using often.

This is the purpose of a Splunk macro and it can be saved in the platform for reuse anywhere that SPL is used in your Splunk instance. To create a new macro, start on the search page and follow these steps:

1. Select Settings > Advanced Search > Search macros
2. Click New to create a search macro
3. Follow the guidance in the macro creation page to finish your macro and save your work.

The macro creation menu in Splunk makes this very easy for you and provides examples for each field you need to fill out. For reference, take a look at this completed example that accepts a string as the first argument that should be a stats function like sum or avg and changes the field name to the string value given to the second argument newName in the macro. Then it appends the dollar sign character to the result and places commas appropriately to produce nice US Dollar formatting of sales data returned by a search.

Once you’ve saved your macro, you can make use of it again in a search by calling it between a pair of back tick characters ` ` followed by the positional arguments. Take a look at this example of the macro created in the last image being used in search.