I have a search that returns all of my correlation searches for a given app. | rest splunk_server=local count=0 /services/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain | search app=my_app | table csearch_name, csearch_label, app, security_domain, qualifiedSearch, description This works fine and gives the desired output. However, I would like to add a line in there that would automatically expand any macros in the qualifiedSearch field. e.g. search `azuread` "body.operationName"="Add member to role" but return: search sourcetype=mscs:azure:eventhub "body.operationName"="Add member to role" Is there a lookup or macroExpand function that I could add to my SPL to do this?
... View more