Available Splunk knowledge objects

There are many different Splunk knowledge objects (SKOs) that can be used within an App. The only required SKO for an App is the addition of views that can be displayed to the end user. We will briefly cover the different types of SKOs that you can include within your App. To avoid any issues with author interpretation of the definitions of these SKOs, we will use the definitions and references from the official Splunk documentation.

Macros

noun

A parameterized portion of a search such as an eval statement or a search term that can be reused in multiple places, including saved and ad hoc searches, and which is used in a manner similar to a search command. Search macros can contain arguments, but they are not required.

Note

This is taken from http://docs.splunk.com/Splexicon:Searchmacro.

Macros are configured through the Advanced Configuration section of the GUI, or via the macros.conf file located within the App. They are advantageous by allowing bits of SPL...