Search code examples
splunksplunk-query

Run predefined search sub-query in splunk

I am using a splunk query which always includes specific sub-query:

host="aaa" OR host ="bbb" OR host="ccc"

So for instance I do 2 different searches like:

host="aaa" OR host ="bbb" OR host="ccc" "MyClass" "id=3"
host="aaa" OR host ="bbb" OR host="ccc" "MyClass" "id=6"

and so on. Is there a way to save somewhere predefined part of the query and reuse it? So I could run my searches like

myquery="hosts_include"  "MyClass" "id=3"
myquery="hosts_include"  "MyClass" "id=6"

Or any other syntax which will simplify my query so I do not have to copy and paste the redundant sub query every time.

Solution

  • Use a macro. Go to Settings->Advanced search->Macros and define a new macro (call it "hosts", for example). Then invoke the macro in your queries by enclosing the name in backticks.

    `hosts` "MyClass" "id=3"
`hosts` "MyClass" "id=6"