Macros, Field Extraction, and Field Aliases
Deep Mehta · Apress eBooks · 2021
Chapter 2 was an overview of the Splunk Search Processing Language (SPL), time modifiers, and the pipeline operator. This chapter discusses field extraction, macros, and field aliases in Splunk and explores SPL by using various queries. Field extraction in Splunk is a process that extracts fields from raw data. Splunk can extract data fields during indexing and searching. Macros in Splunk are a reusable block (content that can be saved for future use) in which you can dynamically set the same logic for different parts or values in the dataset. Macros are useful when you want to frequently run the search command because it saves you from rewriting the whole command. Field aliases in Splunk provide fields alternate names. Field aliases correlate with various events that have similar field values.