Large Splunk Deployment Modification: Base Search Macro

[w3ttr3y]

All of the dashboards use a common base search: source="mhn-splunk.log"

I would like to request a macro be used instead.

You could default the macro to the same value (although I have a different suggestion).

By leveraging a macro, you are inserting a seem (thinks seems from software engineering) that allows an administrator to modify what data is searched. This is particularly helpful in large deployments when search optimizations can make a big difference.

My personal suggestion would be to:

1. Switch from source to sourcetype; this is more standard Splunk behavior. Since the current instructions do not suggest settings a sourcetype, the sourcetype is likely mhn-splunk OR mhn-splunk-i where i is an integer (from sourcetype learning) or mhn-splunk-toosmall (if not enough data had been seen for learned sourcetyping). By using sourcetype=splunk-mhn* you will match all of those sourcetypes
2. Add the index macro requested in Large Splunk Deployment Modifications: Use an index macro #5
3. For our deployment, I am setting a sourcetype on the input and I'm using mhn, so I think the best combination given the current situation (historical non-sourcetyped) and the suggested best practice of setting a sourcetype on the inputs.