Macros

infoblox_index: 

• This macro is used in all the infoblox dashboards that are populated on indexed data. Default value is  index IN ("main"). 

• User can update the macro by following this steps:

  • On Splunk's menu bar, Click on Settings -> “Advanced search” -> “Search Macros”.

  • Search "infoblox_index" macro

  • Click on the “infoblox_index” macro and mention the index name in the Definition where data is incoming. Please see the sample below.

    • index IN (“main” , “sample2”)

  • Click on the Save Button.

summariesonly: 

• This refers to a macro which indicates (summariesonly=true) meaning only search data that has been summarized by the data model acceleration. Summarized data will be available once you've enabled data model acceleration for the data model Infoblox. Default value is summariesonly=false.

• User can update the macro by following this steps:

  • On Splunk's menu bar, Click on Settings -> “Advanced search” -> “Search Macros”.

  • Search "summariesonly" macro

  • Click on the “summariesonly” macro and update it true. Please see the sample below.

    • summariesonly=true

  • Click on the Save Button.