SPLK-1004: Splunk Core Certified Advanced Power User

Question

When a nested macro expands into a search string that starts with a generating command, what extra syntax is required?

Explanation

In Splunk, a macro that expands to a generating command must be invoked with a leading pipe character. Generating commands must start the search pipeline, so the pipe is placed before the macro reference rather than in the macro definition.

Learn more

Define search macros in Settings — Splunk Documentation

SPLK-1004: Splunk Core Certified Advanced Power User

AstroTutor

Notes

Readiness

QuestionQ3

Community Discussion